Description
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever.
Remediation
References
Related Vulnerabilities
MediaWiki Improper Input Validation Vulnerability (CVE-2017-8815)
Jboss EAP CVE-2021-32029 Vulnerability (CVE-2021-32029)
MySQL CVE-2018-3080 Vulnerability (CVE-2018-3080)
WordPress Plugin External 'Video for Everybody' Cross-Site Scripting (2.0)
Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-5497)