CVE-2020-15842

Description

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.57

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2023-47798,CVE-2021-33322,CVE-2021-33320,CVE-2021-33324,CVE-2020-15842 are fixed in Liferay - release.dxp.bom 7.2.10	Windows
Vulnerabilities CVE-2020-15842 are fixed in Liferay - release.dxp.bom 7.0.10	Windows
Vulnerabilities CVE-2020-15842,CVE-2020-15841 are fixed in Liferay - release.dxp.bom 7.1.10	Windows
Vulnerabilities CVE-2020-15842,CVE-2020-15841 are fixed in Liferay - release.portal.bom 7.3.0	Windows
Vulnerabilities CVE-2023-47798,CVE-2021-33322,CVE-2021-33320,CVE-2021-33324,CVE-2020-15842 are fixed in Liferay - release.dxp.bom for Linux 7.2.10	Linux
Vulnerabilities CVE-2020-15842 are fixed in Liferay - release.dxp.bom for Linux 7.0.10	Linux
Vulnerabilities CVE-2020-15842,CVE-2020-15841 are fixed in Liferay - release.dxp.bom for Linux 7.1.10	Linux
Vulnerabilities CVE-2020-15842,CVE-2020-15841 are fixed in Liferay - release.portal.bom for Linux 7.3.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234