Description

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever.

Remediation

References

CVE-2020-28884

Related Vulnerabilities

WordPress Plugin Invite Anyone PHP Object Injection (1.3.18)

WordPress Plugin Images to WebP Multiple Vulnerabilities (1.8)

Oracle Database Server CVE-2009-1019 Vulnerability (CVE-2009-1019)

Oracle JRE CVE-2014-2427 Vulnerability (CVE-2014-2427)

Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2017-7659)

Severity

High

Classification

CVE-2020-28884 CWE-138

Tags

Missing Update Known Vulnerabilities