Description

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Remediation

References

CVE-2020-15840

Related Vulnerabilities

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-12099)

Oracle Database Server CVE-2019-2749 Vulnerability (CVE-2019-2749)

Oracle JRE CVE-2013-5849 Vulnerability (CVE-2013-5849)

WordPress Plugin Super CAPTCHA 'admin.php' SQL Injection (2.2.4)

Squid Improper Input Validation Vulnerability (CVE-2009-2855)

Severity

Medium

Classification

CVE-2020-15840 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities