What is GHSA-8j5r-9687-88w5?

GHSA-8j5r-9687-88w5 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal and Liferay DXP Fails to Sanitize API Data

Which CVE IDs does GHSA-8j5r-9687-88w5 cover?

GHSA-8j5r-9687-88w5 covers the following CVE IDs: CVE-2020-13444. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8j5r-9687-88w5?

GHSA-8j5r-9687-88w5 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8j5r-9687-88w5?

GHSA-8j5r-9687-88w5 affects 4 products, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.0.0, \u003c 7.3.2; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.0.0, \u003c 7.0.10.fp92; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.1.0, \u003c 7.1.10.fp19; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.2.0, \u003c 7.2.10.fp7.

GHSA-8j5r-9687-88w5MediumCVSS 6.5

Liferay Portal and Liferay DXP Fails to Sanitize API Data

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

May 14, 2025

🔗 CVE IDs covered (1)

CVE-2020-13444 →

📋 Description

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

🎯 Affected products4

maven/com.liferay.portal:release.portal.bom:>= 7.0.0, < 7.3.2
maven/com.liferay.portal:release.dxp.bom:>= 7.0.0, < 7.0.10.fp92
maven/com.liferay.portal:release.dxp.bom:>= 7.1.0, < 7.1.10.fp19
maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-13444
https://issues.liferay.com/browse/LPE-17009
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396
https://github.com/advisories/GHSA-8j5r-9687-88w5