CVEvulnerability

CVE-2020-15840

5.3 MEDIUM Published 2020-09-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N

Description

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Affected configurations

• liferay digital experience platform 7.0 • liferay digital experience platform 7.1 • liferay digital experience platform 7.2 • liferay liferay portal (< 7.3.1) • liferay liferay portal 6.2

References