Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-3855: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Comm...

CVE-2021-3855 · published 3 years ago

Summary

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection.

This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462.

What to do

Update liman port_mys to version 1.8.3-462 or later.

Affected software

Vendor	Product	Affected versions
liman	port_mys	>= 1.7.0, < 1.8.3-462 `cpe:2.3:a:liman:port_mys::::::::`

Original advisory text

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0109
https://docs.liman.dev/baslangic/guvenlik Vendor Advisory
https://www.usom.gov.tr/bildirim/tr-23-0109 Third Party Advisory US Government Resource

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

2% chance of attack within 30 days

Type

CWE-77Command Injection

Timeline

Published1 Mar 2023

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-3855 · NVD

Track software like this

Free during beta