CVE-2021-33990

2023-04-1600:00:00

mitre

github.com

liferay portal 6.2.5

command fileupload

security vulnerability

AI Score

6.8

Confidence

Low

EPSS

0.066

Percentile

93.8%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:liferay:portal:6.2.5:*:*:*:*:*:*:*"
    ],
    "vendor": "liferay",
    "product": "portal",
    "versions": [
      {
        "status": "affected",
        "version": "6.2.5"
      }
    ],
    "defaultStatus": "unknown"
  }
]