CVE-2020-15841
Published:July 20, 2020
Updated:November 02, 2026
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
Affected Packages
com.liferay.portal:release.portal.bom (JAVA):
Affected version(s) >=7.2.0 <7.3.0Fix Suggestion:
Update to version 7.3.0com.liferay.portal:release.dxp.bom (JAVA):
Affected version(s) >=7.1.10 <7.1.10.fp17Fix Suggestion:
Update to version 7.1.10.fp17com.liferay.portal:release.dxp.bom (JAVA):
Affected version(s) >=7.2.1 <7.2.10.fp4Fix Suggestion:
Update to version 7.2.10.fp4com.liferay.portal:release.dxp.bom (JAVA):
Affected version(s) >=7.0.10.fp60 <7.0.10.fp89Fix Suggestion:
Update to version 7.0.10.fp89Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
8.3
Attack Complexity
HIGH
Attack Vector
NETWORK
Availability
HIGH
Confidentiality
HIGH
Integrity
HIGH
Privileges Required
NONE
Scope
CHANGED
User Interaction
REQUIRED
Weakness Type (CWE)
Insufficiently Protected Credentials
EPSS
Base Score:
1.51