CVE-2020-13444

2020-06-1019:15:09

Google

osv.dev

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.1%

JSON

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

CPENameOperatorVersion
liferay-portaleq7.2.0-m2
liferay-portaleq7.1.0-a2
liferay-portaleqsync-3.0.6-b7
liferay-portaleqsync-3.0.8-b9
liferay-portaleq6.1.0-b4
liferay-portaleq7.1.0-rc1
liferay-portaleq7.2.0-rc3
liferay-portaleq7.2.0-rc2
liferay-portaleq7.1.0-b1
liferay-portaleq7.2.0-ga1

Name	Operator	Version
liferay-portal	eq	7.2.0-m2
liferay-portal	eq	7.1.0-a2
liferay-portal	eq	sync-3.0.6-b7
liferay-portal	eq	sync-3.0.8-b9
liferay-portal	eq	6.1.0-b4
liferay-portal	eq	7.1.0-rc1
liferay-portal	eq	7.2.0-rc3
liferay-portal	eq	7.2.0-rc2
liferay-portal	eq	7.1.0-b1
liferay-portal	eq	7.2.0-ga1