PT-2020-14663 · Liferay · Liferay Portal+1

Published 2020-09-24 · Updated 2025-05-13 · CVE-2020-15840

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.3.1 Liferay Portal 6.2 EE Liferay DXP versions prior to 7.2

Description The issue allows the property 'portlet.resource.id.banned.paths.regexp' to be bypassed using doubled encoded URLs.

Recommendations For Liferay Portal versions prior to 7.3.1, update to version 7.3.1 or later. For Liferay Portal 6.2 EE, consider disabling the use of the 'portlet.resource.id.banned.paths.regexp' property until a patch is available. For Liferay DXP versions prior to 7.2, update to version 7.2 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2020-15840

GHSA-VRWX-Q9PJ-X488

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-vrwx-q9pj-x488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15840 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15840 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17046 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/122014 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JAVA-COMLIFERAYPORTAL-1296538 · Note