CVE-2020-15840

5.3 mediumEPSS 1.2%

Medium (5.3) in liferay. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:com.liferay.portal.impl 7.1.3, 7.4.0.

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
Published: 2020-09-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

liferay:digital_experience_platform
liferay:liferay_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:com.liferay.portal.impl	>=7.2.0 <7.4.0	7.4.0
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:release.dxp.bom	<7.0.10.fp93	7.0.10.fp93
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:release.dxp.bom	>=7.1.0 <7.1.10.fp19	7.1.10.fp19
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:release.dxp.bom	>=7.2.0 <7.2.10.fp7	7.2.10.fp7
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:release.portal.bom	<7.3.1	7.3.1
GHSA-vrwx-q9pj-x488	Maven	com.liferay.portal:com.liferay.portal.impl	<7.1.3	7.1.3

References

Check your stack JSON