Lucene search

[email protected]CVE-2020-15839

HistorySep 22, 2020 - 6:15 p.m.

CVE-2020-15839

2020-09-2218:15:23

CWE-434

[email protected]

web.nvd.nist.gov

cve-2020-15839

liferay portal

liferay dxp

denial-of-service

file upload vulnerability

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.0%

JSON

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

Affected configurations

NVD

Node

liferaydigital_experience_platformMatch7.1-

liferaydigital_experience_platformMatch7.1fix_pack_1

liferaydigital_experience_platformMatch7.1fix_pack_10

liferaydigital_experience_platformMatch7.1fix_pack_11

liferaydigital_experience_platformMatch7.1fix_pack_12

liferaydigital_experience_platformMatch7.1fix_pack_13

liferaydigital_experience_platformMatch7.1fix_pack_14

liferaydigital_experience_platformMatch7.1fix_pack_15

liferaydigital_experience_platformMatch7.1fix_pack_16

liferaydigital_experience_platformMatch7.1fix_pack_17

liferaydigital_experience_platformMatch7.1fix_pack_2

liferaydigital_experience_platformMatch7.1fix_pack_3

liferaydigital_experience_platformMatch7.1fix_pack_4

liferaydigital_experience_platformMatch7.1fix_pack_5

liferaydigital_experience_platformMatch7.1fix_pack_6

liferaydigital_experience_platformMatch7.1fix_pack_7

liferaydigital_experience_platformMatch7.1fix_pack_8

liferaydigital_experience_platformMatch7.1fix_pack_9

liferaydigital_experience_platformMatch7.1sp1

liferaydigital_experience_platformMatch7.2-

liferaydigital_experience_platformMatch7.2fix_pack_1

liferaydigital_experience_platformMatch7.2fix_pack_2

liferaydigital_experience_platformMatch7.2fix_pack_3

liferaydigital_experience_platformMatch7.2fix_pack_4

liferaydigital_experience_platformMatch7.2fix_pack_5

liferayliferay_portalRange<7.3.3

CPENameOperatorVersion
liferay:digital_experience_platformliferay digital experience platformeq7.1
liferay:digital_experience_platformliferay digital experience platformeq7.2
liferay:liferay_portalliferay liferay portallt7.3.3

CPE	Name	Operator	Version
liferay:digital_experience_platform	liferay digital experience platform	eq	7.1
liferay:digital_experience_platform	liferay digital experience platform	eq	7.2
liferay:liferay_portal	liferay liferay portal	lt	7.3.3

References

issues.liferay.com/browse/LPE-17029

issues.liferay.com/browse/LPE-17055

portal.liferay.dev/learn/security/known-vulnerabilities

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.0%

JSON

Related for CVE-2020-15839

osv3 cvelist1 prion1 veracode1 openvas1 github1 nvd1