CVE-2020-13445

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict…

published June 10, 2020

CVSS
—
EPSS
4%
Percentile
89.6
In the wild
Unconfirmed
What it is

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03686 · 89.6th percentile
Published
2020-06-10T18:09Z
EPSS history
Timeline
  • 10 JUN 18:09Z
    In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict…
    cvelistv5