CVE-2020-15841 Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection

What is CVE-2020-15841?

CVE-2020-15841 is a high-severity vulnerability in Liferay Digital Experience Platform, published on 20 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.

Which versions are affected by CVE-2020-15841?

8 open source packages ship an affected version, including com.liferay.portal:release.dxp.bom and com.liferay.portal:release.portal.bom. It affects 2 products.

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2020-15841?

Upgrade com.liferay.portal:release.dxp.bom to a fixed version for your release line: 7.0.10.fp89, 7.1.10.fp17 or 7.2.10.fp4.

Is CVE-2020-15841 being exploited?

There is no known exploitation of CVE-2020-15841 in the wild and no public exploit code.

Other vulnerabilities in Liferay Digital Experience Platform

• CVE-2024-8980 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console Critical 9.6
• CVE-2023-42496 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting Critical 9.6
• CVE-2023-42498 Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting Critical 9.6
• CVE-2024-25147 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Critical 9.6
• CVE-2024-26269 Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting Critical 9.6

All Liferay Digital Experience Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-773f-f929-qgjj.