CVE-2020-15840

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15840
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15840.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15840
Aliases
Published
2020-09-24T15:15:14.080Z
Modified
2026-07-08T05:59:25.014649468Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:*:*:*:*:*:*:*"
            ],
            "vendor_product": "liferay:digital_experience_platform",
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                },
                {
                    "introduced": "7.1"
                },
                {
                    "last_affected": "7.1"
                },
                {
                    "introduced": "7.2"
                },
                {
                    "last_affected": "7.2"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:liferay:liferay_portal:6.2:-:*:*:enterprise:*:*:*"
            ],
            "vendor_product": "liferay:liferay_portal",
            "extracted_events": [
                {
                    "introduced": "6.2-NA"
                },
                {
                    "last_affected": "6.2-NA"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4ffdd7225ef4a5fd922703263a3006a741a4d8d0
Database specific 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.3.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

6.*
6.1.0-b1
6.1.0-b2
6.1.0-b3
6.1.0-b4
6.1.0-rc1
6.2.0-b1
6.2.0-b2
6.2.0-m2
6.2.0-m3
6.2.0-m4
6.2.0-m5
6.2.0-m6
7.*
7.0.0-m1
7.0.0-m2
7.0.0-m3
7.0.0-m4
7.0.0-m5
7.1.0-a1
7.1.0-a2
7.1.0-b1
7.1.0-b2
7.1.0-m1
7.1.0-m2
7.2.0-a1
7.2.0-b1
7.2.0-b2
7.2.0-b3
7.2.0-m2
7.3.0-ga1
sync-3.*
sync-3.0.0-b1
sync-3.0.1-b2
sync-3.0.10-ga2
sync-3.0.2-b3
sync-3.0.3-b4
sync-3.0.4-b5
sync-3.0.5-b6
sync-3.0.6-b7
sync-3.0.7-b8
sync-3.0.8-b9
sync-3.0.9-ga1
sync-3.1.0-ga1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15840.json"