Lucene search

MitreCVE-2020-15840

HistorySep 24, 2020 - 3:15 p.m.

CVE-2020-15840

2020-09-2415:15:14

mitre

web.nvd.nist.gov

cve-2020-15840

liferay portal

security vulnerability

bypass

encoded urls

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

50.7%

JSON

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property ‘portlet.resource.id.banned.paths.regexp’ can be bypassed with doubled encoded URLs.

Affected configurations

Nvd

Node

liferaydxpMatch7.0

liferaydxpMatch7.1

liferaydxpMatch7.2

liferayliferay_portalRange<7.3.1

liferayliferay_portalMatch6.2-enterprise

VendorProductVersionCPE
liferaydxp7.0cpe:2.3:a:liferay:dxp:7.0:*:*:*:*:*:*:*
liferaydxp7.1cpe:2.3:a:liferay:dxp:7.1:*:*:*:*:*:*:*
liferaydxp7.2cpe:2.3:a:liferay:dxp:7.2:*:*:*:*:*:*:*
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
liferayliferay_portal6.2cpe:2.3:a:liferay:liferay_portal:6.2:-:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
liferay	dxp	7.0	cpe:2.3:a:liferay:dxp:7.0:::::::*
liferay	dxp	7.1	cpe:2.3:a:liferay:dxp:7.1:::::::*
liferay	dxp	7.2	cpe:2.3:a:liferay:dxp:7.2:::::::*
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal::::::::
liferay	liferay_portal	6.2	cpe:2.3:a:liferay:liferay_portal:6.2:-:::enterprise:::*

References

issues.liferay.com/browse/LPE-17046

portal.liferay.dev/learn/security/known-vulnerabilities

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

50.7%

JSON

Related for CVE-2020-15840