CVE-2020-15839

moderate-risk
Published 2020-09-22

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

Do I need to act?

~
1.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Liferay

References (8)

Vendor Advisory https://issues.liferay.com/browse/LPE-17029
Vendor Advisory https://issues.liferay.com/browse/LPE-17055
Vendor Advisory https://portal.liferay.dev/learn/security/known-vulnerabilities
Vendor Advisory https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publishe...
Vendor Advisory https://issues.liferay.com/browse/LPE-17029
Vendor Advisory https://issues.liferay.com/browse/LPE-17055
Vendor Advisory https://portal.liferay.dev/learn/security/known-vulnerabilities
Vendor Advisory https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publishe...
48
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 3/34 · Minimal
Exposure 21/34 · High