Shell command injection in Liferay Portal

2022-05-1703:05:00

Google

osv.dev

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.1%

JSON

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

CPENameOperatorVersion
com.liferay.portal:portal-serviceeq6.2.0-RC5
com.liferay.portal:portal-serviceeq6.2.0-B1
com.liferay.portal:portal-impleq6.2.0-B1
com.liferay.portal:portal-serviceeq5.2.3
com.liferay.portal:portal-impleq6.0.6
com.liferay.portal:portal-impleq6.2.0-RC3
com.liferay.portal:portal-serviceeq6.2.0-RC3
com.liferay.portal:portal-impleq6.2.0-RC5
com.liferay.portal:portal-serviceeq6.1.2
com.liferay.portal:portal-impleq6.2.2

Name	Operator	Version
com.liferay.portal:portal-service	eq	6.2.0-RC5
com.liferay.portal:portal-service	eq	6.2.0-B1
com.liferay.portal:portal-impl	eq	6.2.0-B1
com.liferay.portal:portal-service	eq	5.2.3
com.liferay.portal:portal-impl	eq	6.0.6
com.liferay.portal:portal-impl	eq	6.2.0-RC3
com.liferay.portal:portal-service	eq	6.2.0-RC3
com.liferay.portal:portal-impl	eq	6.2.0-RC5
com.liferay.portal:portal-service	eq	6.1.2
com.liferay.portal:portal-impl	eq	6.2.2

Rows per page:

1-10 of 501

References

dev.liferay.com/web/community-security-team/known-vulnerabilities

dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templates

github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91

issues.liferay.com/browse/LPE-14964

issues.liferay.com/browse/LPS-64547

issues.liferay.com/browse/LPS-7087

nvd.nist.gov/vuln/detail/CVE-2010-5327