CVE-2020-15839

2020-09-2218:15:23

Google

osv.dev

6.5 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.0%

JSON

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

CPENameOperatorVersion
liferay-portaleq6.1.0-b1
liferay-portaleq6.2.0-m4
liferay-portaleq7.2.0-b3
liferay-portaleq7.1.0-a1
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.2-b3
liferay-portaleqsync-3.0.3-b4
liferay-portaleq6.2.0-m3
liferay-portaleq7.3.2-ga3
liferay-portaleq7.2.0-m2

Name	Operator	Version
liferay-portal	eq	6.1.0-b1
liferay-portal	eq	6.2.0-m4
liferay-portal	eq	7.2.0-b3
liferay-portal	eq	7.1.0-a1
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.2-b3
liferay-portal	eq	sync-3.0.3-b4
liferay-portal	eq	6.2.0-m3
liferay-portal	eq	7.3.2-ga3
liferay-portal	eq	7.2.0-m2