CVE-2021-29053

2021-05-1711:15:07

Google

osv.dev

8.4 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

44.3%

JSON

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.

CPENameOperatorVersion
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.1-b2
liferay-portaleq7.2.0-b1
liferay-portaleq7.3.0-ga1
liferay-portaleq7.3.4-ga5
liferay-portaleqsync-3.0.3-b4
liferay-portaleq6.2.0-b1
liferay-portaleq7.0.0-m1
liferay-portaleqsync-3.0.4-b5
liferay-portaleq7.3.1-ga2

Name	Operator	Version
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.1-b2
liferay-portal	eq	7.2.0-b1
liferay-portal	eq	7.3.0-ga1
liferay-portal	eq	7.3.4-ga5
liferay-portal	eq	sync-3.0.3-b4
liferay-portal	eq	6.2.0-b1
liferay-portal	eq	7.0.0-m1
liferay-portal	eq	sync-3.0.4-b5
liferay-portal	eq	7.3.1-ga2