CVE-2020-28884

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute an...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

参照URL

advisory learn.liferay.com
web medium.com