CVE-2020-15839

EPSS 2.16%
Veröffentlicht 22.09.2020 18:15:23
Zuletzt bearbeitet 21.11.2024 05:06:17
Erkennungen
Login

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

NVD 26 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version 7.1 Update -

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_17

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.1 Update sp1

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5

Liferay ≫ Liferay Portal Version < 7.3.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.16%	0.799

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NIST	4	8	2.9	AV:N/AC:L/Au:S/C:N/I:N/A:P

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://portal.liferay.dev/learn/security/known-vulnerabilities

Vendor Advisory

https://issues.liferay.com/browse/LPE-17029

Vendor Advisory

https://issues.liferay.com/browse/LPE-17055

Vendor Advisory

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-15839

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-15839

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-15839

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-15839