Description
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.
Remediation
References
Related Vulnerabilities
MySQL CVE-2017-3647 Vulnerability (CVE-2017-3647)
MySQL CVE-2015-0500 Vulnerability (CVE-2015-0500)
Apache Tomcat Incomplete Cleanup Vulnerability (CVE-2023-42795)
WordPress Plugin Jigoshop Unspecified Vulnerability (1.10.5)
WordPress Plugin Default Facebook Thumbnails Multiple Vulnerabilities (0.4)