From 59ad6254e45d265b6260e30838b22ad126ae78a6 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 14 May 2025 07:27:24 +0000
Subject: [PATCH] Publish Advisories

GHSA-8j5r-9687-88w5
GHSA-8j5r-9687-88w5
---
 .../GHSA-8j5r-9687-88w5.json                  | 122 ++++++++++++++++++
 .../GHSA-8j5r-9687-88w5.json                  |  33 -----
 2 files changed, 122 insertions(+), 33 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json b/advisories/github-reviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
new file mode 100644
index 00000000000..ad8f66aac01
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
@@ -0,0 +1,122 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8j5r-9687-88w5",
+  "modified": "2025-05-14T07:26:42Z",
+  "published": "2022-05-24T17:20:05Z",
+  "aliases": [
+    "CVE-2020-13444"
+  ],
+  "summary": "Liferay Portal and Liferay DXP Fails to Sanitize API Data",
+  "details": "Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.portal.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.3.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.0.10.fp92"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.1.0"
+            },
+            {
+              "fixed": "7.1.10.fp19"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.2.0"
+            },
+            {
+              "fixed": "7.2.10.fp7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liferay/liferay-portal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.liferay.com/browse/LPE-17009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-14T07:26:04Z",
+    "nvd_published_at": "2020-06-10T19:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json b/advisories/unreviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
deleted file mode 100644
index 23ec77aa0de..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-8j5r-9687-88w5/GHSA-8j5r-9687-88w5.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-8j5r-9687-88w5",
-  "modified": "2022-05-24T17:20:05Z",
-  "published": "2022-05-24T17:20:05Z",
-  "aliases": [
-    "CVE-2020-13444"
-  ],
-  "details": "Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 19, and 7.2 before fix pack 7, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444"
-    },
-    {
-      "type": "WEB",
-      "url": "https://issues.liferay.com/browse/LPE-17009"
-    },
-    {
-      "type": "WEB",
-      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2020-06-10T19:15:00Z"
-  }
-}
\ No newline at end of file