cve.bz

CVE-2020-13444

6.5 mediumEPSS 1.6%

Medium (6.5) in liferay liferay portal. EPSS 1.6% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.3.2.

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8j5r-9687-88w5Mavencom.liferay.portal:release.portal.bom>=7.0.0 <7.3.27.3.2
GHSA-8j5r-9687-88w5Mavencom.liferay.portal:release.dxp.bom>=7.0.0 <7.0.10.fp927.0.10.fp92
GHSA-8j5r-9687-88w5Mavencom.liferay.portal:release.dxp.bom>=7.1.0 <7.1.10.fp197.1.10.fp19
GHSA-8j5r-9687-88w5Mavencom.liferay.portal:release.dxp.bom>=7.2.0 <7.2.10.fp77.2.10.fp7

References

Check your stackJSON