CVE-2020-15841

2020-07-2002:15:11

Google

osv.dev

7.1 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

77.6%

JSON

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server’s password via the Test LDAP Connection feature.

CPENameOperatorVersion
liferay-portaleq7.2.0-m2
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.6-b7
liferay-portaleqsync-3.0.8-b9
liferay-portaleq6.1.0-b4
liferay-portaleq7.1.0-b1
liferay-portaleqsync-3.0.4-b5
liferay-portaleqsync-3.0.7-b8
liferay-portaleq7.1.0-m2
liferay-portaleq7.2.0-b1

Name	Operator	Version
liferay-portal	eq	7.2.0-m2
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.6-b7
liferay-portal	eq	sync-3.0.8-b9
liferay-portal	eq	6.1.0-b4
liferay-portal	eq	7.1.0-b1
liferay-portal	eq	sync-3.0.4-b5
liferay-portal	eq	sync-3.0.7-b8
liferay-portal	eq	7.1.0-m2
liferay-portal	eq	7.2.0-b1