CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

CVSS 8.6 HIGHEPSS 1.4%CWE-78

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 ene 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

LiteSpeed Technologies Inc · LiteSpeed Web Server Enterprise

Referencias

https://www.exploit-db.com/exploits/49523 https://www.litespeedtech.com/https://www.litespeedtech.com/products https://www.vulncheck.com/advisories/litespeed-web-server-enterprise-command-injection