Security Listings
Description
In Liferay Portal before 7.3.2, the template API does not restrict user access to to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
Workaround: Review users who have permission to add and edit FreeMarker/Velocity templates. Only trusted users should be granted with the necessary permissions to add and edit templates. Reviewing the owners of existing templates may also be necessary as they have full privileges over their given templates.
Severity
Severity 1
Fixed Version(s)
- Liferay Portal 7.3.2
- June 2020 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page.
- June 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page.
Notes
CVE-2020-13445 has been assigned to this vulnerability.
Acknowledgments
This issue was reported by Alvaro Muñoz (@pwntester)
Publication Date:
June 9, 2020
Found a Bug?
If you have found, or think you have found a bug, help us to help you by letting us know!
Found a Security Vulnerability?
There's a different process available if you have a security issue to report...
Hall of Fame!
Raise your profile - report security vulnerabilities and enter the Hall of Fame!
Community
Company
Feedback