CVE-2010-5327

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-01-13

Last modified

2024-08-07

Weaknesses

CWE-264

Affected products

• Liferay Portal (Liferay)

References

• https://dev.liferay.com/web/community-security-team/known-vulnerabilities
• https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64…
• https://github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91
• https://issues.liferay.com/browse/LPE-14964
• https://issues.liferay.com/browse/LPS-64547
• https://issues.liferay.com/browse/LPS-7087