GitHub Advisoryadvisory · Maven

GHSA-8j5r-9687-88w5 Liferay Portal and Liferay DXP Fails to Sanitize API Data

MEDIUM Published 2022-05-24 Modified 2025-05-14 Official page ↗
Aliases
CVE-2020-13444
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-05-14

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.0.0, < 7.3.2 → fixed in 7.3.2 • Maven com.liferay.portal:release.dxp.bom: >= 7.0.0, < 7.0.10.fp92 → fixed in 7.0.10.fp92 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp19 → fixed in 7.1.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp7 → fixed in 7.2.10.fp7

Description

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

Related

Alias · CVE (1)

  • CVE-2020-13444 Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References