Vulnerability Database

290,020

Total vulnerabilities in the database

CVE-2020-13444

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

  • Published: Jun 10, 2020
  • Updated: Apr 13, 2023
  • CVE: CVE-2020-13444
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 4
  • AV:N/AC:L/Au:S/C:P/I:N/A:N

No CWE or OWASP classifications available.

Software From Fixed in
liferay / liferay_portal 7.1.1-ga2 7.1.1-ga2.x
liferay / liferay_portal 7.1-ga1 7.1-ga1.x
liferay / liferay_portal 7.1-ga2 7.1-ga2.x
liferay / liferay_portal 7.1-ga3 7.1-ga3.x
liferay / liferay_portal 7.2-ga1 7.2-ga1.x
liferay / liferay_portal 7.3-ga2 7.3-ga2.x
liferay / liferay_portal 7.3-ga1 7.3-ga1.x