{
"id": "GHSA-c7f6-4vx5-4263",
"aliases": [
"CVE-2020-15839"
],
"details": "Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.",
"summary": "Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.10.fp18"
}
]
}
],
"package": {
"name": "com.liferay.portal:release.dxp.bom",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "<= 7.1.10.fp17"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.1"
},
{
"fixed": "7.2.10.fp6"
}
]
}
],
"package": {
"name": "com.liferay.portal:release.dxp.bom",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "<= 7.2.10.fp5"
}
}
],
"modified": "2021-05-03T17:25:30Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2022-02-10T20:46:21Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15839",
"type": "ADVISORY"
},
{
"url": "https://issues.liferay.com/browse/LPE-17029",
"type": "WEB"
},
{
"url": "https://issues.liferay.com/browse/LPE-17055",
"type": "WEB"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities",
"type": "WEB"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2020-09-22T18:15:00Z",
"github_reviewed_at": "2021-05-03T17:25:30Z"
}
}