PT-2022-8910 · Liferay · Liferay Portal Server

Published 2022-01-28 · Updated 2024-08-04 · CVE-2020-28885

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Liferay Portal Server versions 7.2.0 GA1 through 7.3.5 GA6

Description The issue allows an administrator user to inject commands through the Gogo Shell module, enabling the execution of any OS command on the Liferay Portal Server. This is disputed by the developer as it is considered a feature for administrators to access and execute commands in Gogo Shell.

Recommendations For versions 7.2.0 GA1 through 7.3.5 GA6, consider restricting access to the Gogo Shell module to minimize the risk of exploitation. As a temporary workaround, consider disabling the Gogo Shell module until a resolution is determined.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-28885

Affected Products

Liferay Portal Server

References · 6

• 🔥 https://medium.com/@tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28885 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28885 · Vendor Advisory
• https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3 · Note
• https://t.me/cvenotify/25963 · Telegram Post
• https://t.me/cibsecurity/36444 · Telegram Post