What is GHSA-97gm-mcv6-cphm?

GHSA-97gm-mcv6-cphm is a security advisory published by GitHub Security Advisories with High severity. Shell command injection in Liferay Portal

Which CVE IDs does GHSA-97gm-mcv6-cphm cover?

GHSA-97gm-mcv6-cphm covers the following CVE IDs: CVE-2010-5327. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-97gm-mcv6-cphm?

GHSA-97gm-mcv6-cphm has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-97gm-mcv6-cphm?

GHSA-97gm-mcv6-cphm affects 2 products, including: maven/com.liferay.portal:portal-impl:\u003c 6.2.11; maven/com.liferay.portal:portal-service:\u003c 6.2.11.

GHSA-97gm-mcv6-cphmHighCVSS 8.8

Shell command injection in Liferay Portal

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 10, 2024

🔗 CVE IDs covered (1)

CVE-2010-5327 →

📋 Description

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

🎯 Affected products2

maven/com.liferay.portal:portal-impl:< 6.2.11
maven/com.liferay.portal:portal-service:< 6.2.11

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2010-5327
https://github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91
https://dev.liferay.com/web/community-security-team/known-vulnerabilities
https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templates
https://issues.liferay.com/browse/LPE-14964
https://issues.liferay.com/browse/LPS-64547
https://issues.liferay.com/browse/LPS-7087
https://github.com/advisories/GHSA-97gm-mcv6-cphm