CVE-2020-15841
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
CVE-2020-15841- CVSS 3.1
- 8.3 High
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R - Updated
- 2026-11-02
EUVDEUVD-2020-7822
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
EUVD-2020-7822- CVSS 3.1
- 8.3 High
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-773f-f929-qgjj
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
GHSA-773f-f929-qgjj- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
CVE-2020-15841- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
OSV
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
CVE-2020-15841- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-773f-f929-qgjj
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
- Record
GHSA-773f-f929-qgjj- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-522
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
before 7.3.0 | 7.3.0 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp89 | 7.0.10.fp89 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp17 | 7.1.10.fp17 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp4 | 7.2.10.fp4 |
com.liferay.portal:release.portal.bomMaven |
before 7.3.0, plus listed versions 7.0.67.0.6-17.0.6-27.1.07.1.1 Show 6 moreShow less7.1.27.1.37.1.3-17.2.07.2.17.2.1-1 |
7.3.0 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp89, plus listed versions 7.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp64 Show 27 moreShow less7.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp88 |
7.0.10.fp89 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp17, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 12 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp27.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
7.1.10.fp17 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp4, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp27.2.10.fp3 |
7.2.10.fp4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15841 is a high vulnerability (CVSS 8.3) in Liferay Portal, published July 20, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in com.liferay.portal:release.portal.bom 7.3.0.