CVE-2019-11444

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortlet_script value to group/control_panel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-114457.2OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home d CVE-2019-114468.8An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Uploa CVE-2019-114478.8An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile ar CVE-2019-114489.8An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain the authority of SYSTE CVE-2019-114496.1I, Librarian 4.10 has XSS via the notes.php notes parameter.CVE-2019-11458.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-114509.8whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection.CVE-2019-114517.2whatsns 4.0 allows index.php?inform/add.html qid SQL injection.CVE-2019-114527.2whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.CVE-2019-114546.1Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introd CVE-2019-114558.1A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the cont CVE-2019-114568.8Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.