GHSA-vrwx-q9pj-x488MediumCVSS 5.3

Liferay Portal and Liferay DXP Bypass via Double Encoded URL

Published
May 24, 2022
Last Modified
May 28, 2025

🔗 CVE IDs covered (1)

CVE-2020-15840 →

📋 Description

In Liferay Portal before 7.3.1, com.liferay.portal:com.liferay.portal.impl before 7.1.3 and 7.4.0, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

🎯 Affected products6

  • maven/com.liferay.portal:com.liferay.portal.impl:>= 7.2.0, < 7.4.0
  • maven/com.liferay.portal:release.dxp.bom:< 7.0.10.fp93
  • maven/com.liferay.portal:release.dxp.bom:>= 7.1.0, < 7.1.10.fp19
  • maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp7
  • maven/com.liferay.portal:release.portal.bom:< 7.3.1
  • maven/com.liferay.portal:com.liferay.portal.impl:< 7.1.3

🔗 References (6)