CVE-2020-28884

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection

published January 28, 2022

CVSS
—
EPSS
2%
Percentile
80.9
In the wild
Unconfirmed
What it is

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02028 · 80.9th percentile
Published
2022-01-28T00:00Z
EPSS history
Timeline
  • 28 JAN 00:00Z
    Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection
    cvelistv5