cve.bz

CVE-2020-13445

8.8 highEPSS 3.7%

High (8.8) in liferay liferay portal. EPSS 3.7% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.3.2.

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
3.7% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWEs
CWE-74, CWE-862
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v377-8f8f-532hMavencom.liferay.portal:release.portal.bom<7.3.27.3.2
GHSA-v377-8f8f-532hMavencom.liferay.portal:release.dxp.bom>=7.0.0 <7.0.10.fp927.0.10.fp92
GHSA-v377-8f8f-532hMavencom.liferay.portal:release.dxp.bom>=7.1.0 <7.1.10.fp187.1.10.fp18
GHSA-v377-8f8f-532hMavencom.liferay.portal:release.dxp.bom>=7.2.0 <7.2.10.fp67.2.10.fp6

References

Check your stackJSON