CVE-2020-15839

Katalog CVE

CVSS 6.5 · Medium EPSS 2,2%

Kerentanan Unrestricted Upload of File with Dangerous Type pada liferay digital experience platform, liferay portal. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

Rincian

Terbit di NVD

22 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://issues.liferay.com/browse/LPE-17029 advisory vendor
• https://issues.liferay.com/browse/LPE-17055 advisory vendor
• https://portal.liferay.dev/learn/security/known-vulnerabilities advisory vendor
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/1197... advisory vendor