UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15840

In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.

Severity
Medium 5.3
Published
24 Sept 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.0
  • Version 7.1
  • Version 7.2
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • Every version before 7.3.1
  • Version 6.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15840
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15840