Liferay Portal 7.1 GA2 Community Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:liferay_portal:7.1:ga2:*:*:community:*:*:*

part: a version: 7.1 update: ga2

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductLiferay Portal (e3d198b8-0678-58dd-bf73-106b66a02cfe)
Edition*
Language*
Software editioncommunity
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/liferay/portal purl2cpe 2026-06-01 10:15:56.340412
pkg:github/liferay/liferay-portal purl2cpe 2026-06-01 10:15:56.340413
pkg:liferay/liferay-portal purl2cpe 2026-06-01 10:15:56.340414
pkg:sourceforge/lportal purl2cpe 2026-06-01 10:15:56.340416

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-13445 vulnerable 2026-06-08 05:18:00.660212 Details available
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
Published: 2020-06-10T18:09:38.000Z
Updated: 2024-08-04T12:18:18.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13444 vulnerable 2026-06-08 05:18:00.656447 Details available
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.
Published: 2020-06-10T18:17:13.000Z
Updated: 2024-08-04T12:18:18.349Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.