CVEvulnerability
CVE-2019-11444
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-04-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw
Affected configurations
• liferay liferay portal 7.1.2
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://dev.liferay.com/discover/portal/-/knowledge_base/7-1/running-scripts-from-the-script-console dev.liferay.com
- https://pentest.com.tr/exploits/Liferay-CE-Portal-Tomcat-7-1-2-ga3-Groovy-Console-Remote-Command-Execution-Metasploit.html Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/46525 Exploit, Third Party Advisory, VDB Entry
- https://dev.liferay.com/discover/portal/-/knowledge_base/7-1/running-scripts-from-the-script-console dev.liferay.com
- https://pentest.com.tr/exploits/Liferay-CE-Portal-Tomcat-7-1-2-ga3-Groovy-Console-Remote-Command-Execution-Metasploit.html Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/46525 Exploit, Third Party Advisory, VDB Entry