CVE-2020-15839
Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
CVE-2020-15839- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
CVE-2020-15839- Updated
- 2026-11-02
EUVDEUVD-2022-0957 No score
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
EUVD-2022-0957- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c7f6-4vx5-4263
Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
GHSA-c7f6-4vx5-4263- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
CVE-2020-15839- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-c7f6-4vx5-4263
Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
GHSA-c7f6-4vx5-4263- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSVBIT-liferay-2020-15839 No score
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
- Record
BIT-liferay-2020-15839- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.dxp.bomMaven |
through 7.1.10.fp17 | 7.1.10.fp18 |
com.liferay.portal:release.dxp.bomMaven |
7.2.1 to 7.2.10.fp5 | 7.2.10.fp6 |
liferayBitnami |
7.1.0 to 7.1.0, 7.2.0 to 7.2.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-sp1.0 to 7.1-sp1.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0 | None known |
com.liferay.portal:release.dxp.bomMaven |
before 7.1.10.fp18, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 |
7.1.10.fp18 |
com.liferay.portal:release.dxp.bomMaven |
7.2.1 up to 7.2.10.fp6, plus listed versions 7.2.107.2.10.fp17.2.10.fp1-17.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp5 |
7.2.10.fp6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15839 is a medium vulnerability (CVSS 6.5) in Liferay Portal, published September 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in com.liferay.portal:release.dxp.bom 7.1.10.fp18.
References
portal.liferay.dev/learn/security/known-vulnerabilities
issues.liferay.com/browse/LPE-17029
nvd.nist.gov/vuln/detail/CVE-2020-15839
github.com/advisories/GHSA-c7f6-4vx5-4263
Left out here: 21 versions. The JSON record has them.