{"id":"CVE-2020-13444","details":"Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.","aliases":["GHSA-8j5r-9687-88w5"],"modified":"2026-09-05T08:10:15.621908Z","published":"2020-06-10T19:15:09.883Z","references":[{"type":"WEB","url":"https://issues.liferay.com/browse/LPE-17009"},{"type":"FIX","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liferay/liferay-portal","events":[{"introduced":"59148a8775a2b2345694a023683d95b478c483c6"},{"last_affected":"0515646c8f638f202d107469cc147172fc7685de"}],"database_specific":{"cpe":["cpe:2.3:a:liferay:liferay_portal:7.1:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.2:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.3:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.3:ga2:*:*:community:*:*:*"],"extracted_events":[{"introduced":"7.1-ga1"},{"last_affected":"7.1-ga1"},{"introduced":"7.1.1-ga2"},{"last_affected":"7.1.1-ga2"},{"introduced":"7.1-ga2"},{"last_affected":"7.1-ga2"},{"introduced":"7.1-ga3"},{"last_affected":"7.1-ga3"},{"introduced":"7.2-ga1"},{"last_affected":"7.2-ga1"},{"introduced":"7.3-ga1"},{"last_affected":"7.3-ga1"},{"introduced":"7.3-ga2"},{"last_affected":"7.3-ga2"}],"source":"CPE_STRING"}}],"versions":["7.1-ga1","7.1-ga2","7.1-ga3","7.2-ga1","7.3-ga1","7.3-ga2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13444.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}