GitHub Advisoryadvisory · Maven

GHSA-773f-f929-qgjj Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection

HIGH Published 2022-05-24 Modified 2025-05-28 Official page ↗
Aliases
CVE-2020-15841
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2025-05-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: < 7.3.0 → fixed in 7.3.0 • Maven com.liferay.portal:release.dxp.bom: >= 7.0.0, < 7.0.10.fp89 → fixed in 7.0.10.fp89 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp17 → fixed in 7.1.10.fp17 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp4 → fixed in 7.2.10.fp4

Description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.

Related

Alias · CVE (1)

  • CVE-2020-15841 Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References