Description

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Remediation

References

CVE-2020-15840

Related Vulnerabilities

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-37062)

Oracle Application Server CVE-2006-0435 Vulnerability (CVE-2006-0435)

Oracle HTTP Server Out-of-bounds Write Vulnerability (CVE-2022-23943)

WordPress Plugin Quick Event Manager Multiple Vulnerabilities (9.7.4)

PHP Out-of-bounds Write Vulnerability (CVE-2016-7126)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CVE-2020-15840