CoreCVE
Back

HIGH

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates

Published Jun 10, 2020

Description

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-862

Missing Authorization

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 10, 2020
Updated Aug 4, 2024
Reserved May 25, 2020
Link CVE-2020-13445
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-13445
Red Hat
Severity n/a
Public date n/a
Links CVE-2020-13445
GHSA-V377-8F8F-532H