Maven package
com.liferay.portal/portal-impl
pkg:maven/com.liferay.portal/portal-impl
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-29038 | — | < 5.18.4 | 5.18.4 | Feb 20, 2024 | Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder | ||
| CVE-2010-5327 | Hig | 8.8 | < 6.2.11 | 6.2.11 | Jan 13, 2017 | Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. |
- CVE-2021-29038Feb 20, 2024affected < 5.18.4fixed 5.18.4
Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder
- affected < 6.2.11fixed 6.2.11
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.