netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8j5r-9687-88w5
GHSA-8j5r-9687-88w5
This commit is contained in:
advisory-database[bot]
2025-05-14 07:27:24 +00:00
parent 7083ab959b
commit 59ad6254e4
2 changed files with 122 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8j5r-9687-88w5",
"modified": "2025-05-14T07:26:42Z",
"published": "2022-05-24T17:20:05Z",
"aliases": [
"CVE-2020-13444"
],
"summary": "Liferay Portal and Liferay DXP Fails to Sanitize API Data",
"details": "Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.3.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.10.fp92"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp19"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17009"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-14T07:26:04Z",
"nvd_published_at": "2020-06-10T19:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
-33
View File
@@ -1,33 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8j5r-9687-88w5",
"modified": "2022-05-24T17:20:05Z",
"published": "2022-05-24T17:20:05Z",
"aliases": [
"CVE-2020-13444"
],
"details": "Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17009"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-10T19:15:00Z"
}
}