CVE-2020-13444 : Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 bef

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.

Published 2020-06-10 19:15:10

Updated 2020-07-16 14:15:11

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-13444

Liferay » Liferay Portal » Version: 7.1.1 Update GA2 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.1.1:ga2:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.1 Update GA1 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.1:ga1:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.1 Update GA2 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.1:ga2:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.1 Update GA3 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.1:ga3:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.2 Update GA1 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.2:ga1:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.3 Update GA1 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.3:ga1:*:*:community:*:*:*
Matching versions
Liferay » Liferay Portal » Version: 7.3 Update GA2 Community Edition
cpe:2.3:a:liferay:liferay_portal:7.3:ga2:*:*:community:*:*:*
Matching versions

Threat overview for CVE-2020-13444

Top countries where our scanners detected CVE-2020-13444

Top open port discovered on systems with this issue 443

IPs affected by CVE-2020-13444 21

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-13444!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-13444

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-13444

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2020-13444

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396

CST-7301 DDMDataProvider API leaks REST data provider password (CVE-2020-13444)
Patch;Vendor Advisory
https://issues.liferay.com/browse/LPE-17009

[LPE-17009] DDMDataProvider API leaks REST data provider password - Liferay Issues

Jump to

Vulnerability Details : CVE-2020-13444

Products affected by CVE-2020-13444

Threat overview for CVE-2020-13444

Exploit prediction scoring system (EPSS) score for CVE-2020-13444

CVSS scores for CVE-2020-13444

References for CVE-2020-13444