CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

CVSS 8.6 HIGHEPSS 1.4%CWE-78

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.6EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

23 jan 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

LiteSpeed Technologies Inc · LiteSpeed Web Server Enterprise

Referências

https://www.exploit-db.com/exploits/49523 https://www.litespeedtech.com/https://www.litespeedtech.com/products https://www.vulncheck.com/advisories/litespeed-web-server-enterprise-command-injection