VULNERABILITY INTELLIGENCE

CVE-2020-13445

CVSS score8.8 HIGH

EPSS probability3.69%

CISA KEVNot currently listed

Published2020-06-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.

Weakness classification

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-862: Missing Authorization

Primary references

cve@mitre.org — Patch, Vendor Advisory
cve@mitre.org — Patch, Vendor Advisory
cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory