CVE-2010-5327 Shell command injection in Liferay Portal

What is CVE-2010-5327?

CVE-2010-5327 is a high-severity code injection vulnerability in Liferay Liferay Portal, published on 13 Jan 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

Weakness: CWE-264

Which versions are affected by CVE-2010-5327?

4 open source packages ship an affected version, including com.liferay.portal:portal-impl and com.liferay.portal:portal-service. It affects 1 product.

Products include Liferay Liferay Portal.

How do I fix CVE-2010-5327?

Upgrade com.liferay.portal:portal-impl to 6.2.11 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2010-5327 being exploited?

There is no known exploitation of CVE-2010-5327 in the wild and no public exploit code.

Other vulnerabilities in Liferay Liferay Portal

• CVE-2020-7961 Liferay Portal Deserialization of Untrusted Data Exploited Critical 9.8
• CVE-2021-33990 File upload in n/a Critical 9.8
• CVE-2019-16891 Liferay Portal Allows RCE via Deserialization of a JSON Payload Critical 9.8
• CVE-2023-47797 Liferay Portal XSS with `p_l_back_url_title` on edit content page Critical 9.6
• CVE-2020-13445 Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution High 8.8

All Liferay Liferay Portal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-97gm-mcv6-cphm.