PT-2020-14662 · Liferay · Liferay Portal+1

Published 2020-09-22 · Updated 2024-01-31 · CVE-2020-15839

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.3.3 Liferay DXP 7.1 versions prior to fix pack 18 Liferay DXP 7.2 versions prior to fix pack 6

Description The issue allows remote authenticated users to conduct denial-of-service attacks by uploading large files due to a lack of restriction on the size of a multipart/form-data POST action.

Recommendations For Liferay Portal versions prior to 7.3.3, update to version 7.3.3 or later. For Liferay DXP 7.1 versions prior to fix pack 18, apply fix pack 18 or later. For Liferay DXP 7.2 versions prior to fix pack 6, apply fix pack 6 or later.

Fix

DoS

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BIT-LIFERAY-2020-15839

CVE-2020-15839

GHSA-C7F6-4VX5-4263

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://portal.liferay.dev/learn/security/known-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2020-15839 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15839 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17029 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15839 · Security Note
• https://osv.dev/vulnerability/GHSA-c7f6-4vx5-4263 · Vendor Advisory