Liferay Portal 7.3 GA2 Community Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:liferay_portal:7.3:ga2:*:*:community:*:*:*

part: a version: 7.3 update: ga2

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductLiferay Portal (e3d198b8-0678-58dd-bf73-106b66a02cfe)
Edition*
Language*
Software editioncommunity
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:docker/liferay/portal purl2cpe 2026-06-01 10:15:56.373435
pkg:github/liferay/liferay-portal purl2cpe 2026-06-01 10:15:56.373436
pkg:liferay/liferay-portal purl2cpe 2026-06-01 10:15:56.373437
pkg:sourceforge/lportal purl2cpe 2026-06-01 10:15:56.373439

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-13445 vulnerable 2026-06-08 05:18:00.660453 Details available
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
Published: 2020-06-10T18:09:38.000Z
Updated: 2024-08-04T12:18:18.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13444 vulnerable 2026-06-08 05:18:00.659694 Details available
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.
Published: 2020-06-10T18:17:13.000Z
Updated: 2024-08-04T12:18:18.349Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.