CVEvulnerability
CVE-2021-47903
8.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-01-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://www.exploit-db.com/exploits/49523 www.exploit-db.com
- https://www.litespeedtech.com/ www.litespeedtech.com
- https://www.litespeedtech.com/products www.litespeedtech.com
- https://www.vulncheck.com/advisories/litespeed-web-server-enterprise-command-injection www.vulncheck.com
- https://www.exploit-db.com/exploits/49523 www.exploit-db.com