Description

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever.

Remediation

References

CVE-2020-28885

Related Vulnerabilities

MySQL CVE-2018-3079 Vulnerability (CVE-2018-3079)

Apache Traffic Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9511)

WordPress Plugin Appointment Hour Booking-WordPress Booking Cross-Site Scripting (1.3.16)

Internet Information Services Other Vulnerability (CVE-2001-0335)

WordPress Plugin cformsII SQL Injection (14.12.3)

Severity

High

Classification

CVE-2020-28885 CWE-138

Tags

Missing Update Known Vulnerabilities