CVE-2020-13445 | BDVDB-2026-137159 Detail

Description#

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411
https://issues.liferay.com/browse/LPE-17023
https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce

Exploit#

No public exploit known

History#

Version 12020-06-10Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.