CVE-2020-13445
First published: Wed Jun 10 2020(Updated: )
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay Liferay Portal | =7.1-ga1 | |
| Liferay Liferay Portal | =7.1-ga2 | |
| Liferay Liferay Portal | =7.1-ga3 | |
| Liferay Liferay Portal | =7.1.1-ga2 | |
| Liferay Liferay Portal | =7.2-ga1 | |
| Liferay Liferay Portal | =7.3-ga1 | |
| Liferay Liferay Portal | =7.3-ga2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/liferay
- canonical/liferay liferay portal
- version/liferay liferay portal/7.1-ga1
- version/liferay liferay portal/7.1-ga2
- version/liferay liferay portal/7.1-ga3
- version/liferay liferay portal/7.1.1-ga2
- version/liferay liferay portal/7.2-ga1
- version/liferay liferay portal/7.3-ga1
- version/liferay liferay portal/7.3-ga2