CVE-2020-15840

2020-09-2415:15:14

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.1%

JSON

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property ‘portlet.resource.id.banned.paths.regexp’ can be bypassed with doubled encoded URLs.

CPENameOperatorVersion
liferay-portaleq6.1.0-b1
liferay-portaleq6.2.0-m4
liferay-portaleq7.2.0-b3
liferay-portaleq7.1.0-a1
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.2-b3
liferay-portaleqsync-3.0.3-b4
liferay-portaleq6.2.0-m3
liferay-portaleq7.2.0-m2
liferay-portaleqsync-3.0.1-b2

Name	Operator	Version
liferay-portal	eq	6.1.0-b1
liferay-portal	eq	6.2.0-m4
liferay-portal	eq	7.2.0-b3
liferay-portal	eq	7.1.0-a1
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.2-b3
liferay-portal	eq	sync-3.0.3-b4
liferay-portal	eq	6.2.0-m3
liferay-portal	eq	7.2.0-m2
liferay-portal	eq	sync-3.0.1-b2