From e9035fc3171b7f58c51fb37bed3892ce2bd77f4b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 14 May 2025 07:29:23 +0000
Subject: [PATCH] Publish Advisories

GHSA-v377-8f8f-532h
GHSA-v377-8f8f-532h
---
 .../GHSA-v377-8f8f-532h.json                  | 126 ++++++++++++++++++
 .../GHSA-v377-8f8f-532h.json                  |  39 ------
 2 files changed, 126 insertions(+), 39 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json b/advisories/github-reviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json
new file mode 100644
index 00000000000..3ed4542a12b
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json
@@ -0,0 +1,126 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-v377-8f8f-532h",
+  "modified": "2025-05-14T07:27:35Z",
+  "published": "2022-05-24T17:20:05Z",
+  "aliases": [
+    "CVE-2020-13445"
+  ],
+  "summary": "Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution",
+  "details": "In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.portal.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "7.3.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.0.10.fp92"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.1.0"
+            },
+            {
+              "fixed": "7.1.10.fp18"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.2.0"
+            },
+            {
+              "fixed": "7.2.10.fp6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13445"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liferay/liferay-portal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.liferay.com/browse/LPE-17023"
+    },
+    {
+      "type": "WEB",
+      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-14T07:27:35Z",
+    "nvd_published_at": "2020-06-10T19:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json b/advisories/unreviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json
deleted file mode 100644
index 1a69c0abf47..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-v377-8f8f-532h/GHSA-v377-8f8f-532h.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-v377-8f8f-532h",
-  "modified": "2022-05-24T17:20:05Z",
-  "published": "2022-05-24T17:20:05Z",
-  "aliases": [
-    "CVE-2020-13445"
-  ],
-  "details": "In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13445"
-    },
-    {
-      "type": "WEB",
-      "url": "https://issues.liferay.com/browse/LPE-17023"
-    },
-    {
-      "type": "WEB",
-      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411"
-    },
-    {
-      "type": "ADVISORY",
-      "url": "https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-74"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2020-06-10T19:15:00Z"
-  }
-}
\ No newline at end of file