CVE-2020-15841

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a…

High · published July 20, 2020

CVSS v3.1
8.3
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.01514 · 74.3th percentile
Published
2020-07-20T01:06Z
EPSS history
Timeline
  • 20 JUL 01:06Z
    Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a…
    cvelistv5