Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-15840

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

VectorNETWORK

PublishedSep 24, 2020, 15:15

Published Bycve@mitre.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

com.liferay.portal:com.liferay.portal.impl(Maven)7.2.07.4.0N/A

com.liferay.portal:release.dxp.bom(Maven)07.0.10.fp93N/A

com.liferay.portal:release.dxp.bom(Maven)7.1.07.1.10.fp19N/A

com.liferay.portal:release.dxp.bom(Maven)7.2.07.2.10.fp7N/A

com.liferay.portal:release.portal.bom(Maven)07.3.1N/A

com.liferay.portal:com.liferay.portal.impl(Maven)07.1.3N/A

References

https://issues.liferay.com/browse/LPE-17046
https://portal.liferay.dev/learn/security/known-vulnerabilities
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK