Description
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
Remediation
References
Related Vulnerabilities
Jboss EAP 7PK - Security Features Vulnerability (CVE-2015-5178)
Atlassian Jira Missing Authorization Vulnerability (CVE-2019-20407)
Apache HTTP Server Use After Free Vulnerability (CVE-2019-0211)
GlassFish CVE-2017-10393 Vulnerability (CVE-2017-10393)
WordPress Plugin Weaver Show Posts Cross-Site Scripting (1.6)