GHSA-773f-f929-qgjjHighCVSS 8.3

Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection

Published
May 24, 2022
Last Modified
May 28, 2025

🔗 CVE IDs covered (1)

CVE-2020-15841 →

📋 Description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.

🎯 Affected products4

  • maven/com.liferay.portal:release.portal.bom:< 7.3.0
  • maven/com.liferay.portal:release.dxp.bom:>= 7.0.0, < 7.0.10.fp89
  • maven/com.liferay.portal:release.dxp.bom:>= 7.1.0, < 7.1.10.fp17
  • maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp4

🔗 References (4)