Description

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever.

Remediation

References

CVE-2020-28885

Related Vulnerabilities

WordPress Plugin 10Web Map Builder for Google Maps Security Bypass (1.0.63)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7940)

Vanilla Forums Improper Input Validation Vulnerability (CVE-2011-0908)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-1032)

PHP Other Vulnerability (CVE-2007-1584)

Severity

High

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2020-28885