Description
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
Remediation
References
Related Vulnerabilities
WordPress Plugin Migration, Backup, Staging-WPvivid Cross-Site Scripting (0.9.55)
Oracle Application Server Other Vulnerability (CVE-2004-1370)
Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33510)
WordPress Plugin Duplicator-WordPress Migration Remote Code Execution (1.2.40)
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-3454)