Remote Code Execution (RCE)

🗓️ 01 Jun 2020 02:43:02Reported by Veracode Vulnerability DatabaseType

portal-impl vulnerable to remote code execution (RCE) due to inadequate class loading restrictions in velocity and freemarker template

Reporter	Title	Published	Views	Family All 10
CNVD	Liferay Portal Command Execution Vulnerability	16 Jan 201700:00	–	cnvd
CVE	CVE-2010-5327	13 Jan 201719:00	–	cve
Cvelist	CVE-2010-5327	13 Jan 201719:00	–	cvelist
EUVD	EUVD-2022-3315	3 Oct 202520:07	–	euvd
Github Security Blog	Shell command injection in Liferay Portal	17 May 202203:05	–	github
NVD	CVE-2010-5327	13 Jan 201719:59	–	nvd
OSV	GHSA-97GM-MCV6-CPHM Shell command injection in Liferay Portal	17 May 202203:05	–	osv
Prion	Design/Logic Flaw	13 Jan 201719:59	–	prion
vulnersOsv	au.com.permeance:liferay-clojure-integration (=0.1), br.com.thiagomoreira.liferay.plugins.bootstrap-jumbotron-app:bootstrap-jumbotron-app (>=1.0.0 <=1.0.1) +94 more potentially affected by CVE-2010-5327 via com.liferay.portal:portal-service (>=5.2.3 <=6.2.1)	17 May 202203:05	–	vulnersosv
vulnersOsv	au.com.permeance:liferay-clojure-integration (=0.1), com.liferay.maven.plugins:liferay-maven-plugin (>=6.0.2 <=6.0.6) +6 more potentially affected by CVE-2010-5327 via com.liferay.portal:portal-impl (>=5.2.3 <=6.2.1)	17 May 202203:05	–	vulnersosv

Vulners

Node

liferay portal-implRange6.2.2–6.2.4java

liferay portal-implMatch7.0.0-nightlyjava

Source	Link
portal	www.portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/113764289
github	www.github.com/community-security-team/liferay-portal/commit/76aaec0256e98bce0c0542ab071d4cf5132e10ca
dev	www.dev.liferay.com/web/community-security-team/known-vulnerabilities
dev	www.dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templates
github	www.github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91
issues	www.issues.liferay.com/browse/LPE-14964
issues	www.issues.liferay.com/browse/LPS-64547
issues	www.issues.liferay.com/browse/LPS-7087

19 Apr 2022 18:27Current

3.4Low risk

Vulners AI Score3.4

CVSS 26.5

CVSS 38.8

EPSS0.01182