Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 G
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.24, 4.0.48, 3.0.67, 2.0.66, 1.0.93
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Liferay Portal
From 7.0.0 · through 7.4.3.4
- Liferay DXP
From 6.2.0 · through portal-173; From 7.0.10 · through de-102; From 7.1.10 · through dxp-28; From 7.2.10 · through dxp-20; From 7.3.10 · through 7.3.10-u34
- com.liferay:com.liferay.server.admin.webMaven
From 5.0.0 · fixed in 5.0.24
- com.liferay:com.liferay.server.admin.webMaven
From 4.0.0 · fixed in 4.0.48
- com.liferay:com.liferay.server.admin.webMaven
From 3.0.0 · fixed in 3.0.67
- com.liferay:com.liferay.server.admin.webMaven
From 2.0.0 · fixed in 2.0.66
- com.liferay:com.liferay.server.admin.webMaven
fixed in 1.0.93