CVE-2020-15839
22.09.2020, 18:15
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.Enginsight
| Vendor | Product | Version |
|---|---|---|
| liferay | digital_experience_platform | 7.1 |
| liferay | digital_experience_platform | 7.1:fix_pack_1 |
| liferay | digital_experience_platform | 7.1:fix_pack_10 |
| liferay | digital_experience_platform | 7.1:fix_pack_11 |
| liferay | digital_experience_platform | 7.1:fix_pack_12 |
| liferay | digital_experience_platform | 7.1:fix_pack_13 |
| liferay | digital_experience_platform | 7.1:fix_pack_14 |
| liferay | digital_experience_platform | 7.1:fix_pack_15 |
| liferay | digital_experience_platform | 7.1:fix_pack_16 |
| liferay | digital_experience_platform | 7.1:fix_pack_17 |
| liferay | digital_experience_platform | 7.1:fix_pack_2 |
| liferay | digital_experience_platform | 7.1:fix_pack_3 |
| liferay | digital_experience_platform | 7.1:fix_pack_4 |
| liferay | digital_experience_platform | 7.1:fix_pack_5 |
| liferay | digital_experience_platform | 7.1:fix_pack_6 |
| liferay | digital_experience_platform | 7.1:fix_pack_7 |
| liferay | digital_experience_platform | 7.1:fix_pack_8 |
| liferay | digital_experience_platform | 7.1:fix_pack_9 |
| liferay | digital_experience_platform | 7.1:sp1 |
| liferay | digital_experience_platform | 7.2 |
| liferay | digital_experience_platform | 7.2:fix_pack_1 |
| liferay | digital_experience_platform | 7.2:fix_pack_2 |
| liferay | digital_experience_platform | 7.2:fix_pack_3 |
| liferay | digital_experience_platform | 7.2:fix_pack_4 |
| liferay | digital_experience_platform | 7.2:fix_pack_5 |
| liferay | liferay_portal | 𝑥 < 7.3.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References