CVE-2020-13445

Published 10 Jun 2020 · Updated 04 Aug 2024

Follow this CVE + Monitor com.liferay.portal:release.portal.bom + Monitor com.liferay.portal:release.dxp.bom

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.7%

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Affected products

n/a · n/a

References

https://issues.liferay.com/browse/LPE-17023 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411 https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce