Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7vss-pq2q-syea
Vulnerability ID VCID-7vss-pq2q-syea
Aliases CVE-2020-15839
GHSA-c7f6-4vx5-4263
Summary Unrestricted Upload of File with Dangerous Type Liferay Portal, and Liferay DXP before fix pack before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01076 https://api.first.org/data/v1/epss?cve=CVE-2020-15839
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c7f6-4vx5-4263
cvssv3.1 6.5 https://issues.liferay.com/browse/LPE-17029
generic_textual MODERATE https://issues.liferay.com/browse/LPE-17029
cvssv3.1 6.5 https://issues.liferay.com/browse/LPE-17055
generic_textual MODERATE https://issues.liferay.com/browse/LPE-17055
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2020-15839
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-15839
cvssv3.1 6.5 https://portal.liferay.dev/learn/security/known-vulnerabilities
generic_textual MODERATE https://portal.liferay.dev/learn/security/known-vulnerabilities
cvssv3.1 6.5 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928
generic_textual MODERATE https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-15839
https://issues.liferay.com/browse/LPE-17029
https://issues.liferay.com/browse/LPE-17055
https://portal.liferay.dev/learn/security/known-vulnerabilities
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928
CVE-2020-15839 https://nvd.nist.gov/vuln/detail/CVE-2020-15839
GHSA-c7f6-4vx5-4263 https://github.com/advisories/GHSA-c7f6-4vx5-4263
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://issues.liferay.com/browse/LPE-17029
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://issues.liferay.com/browse/LPE-17055
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15839
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://portal.liferay.dev/learn/security/known-vulnerabilities
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78101
EPSS Score 0.01076
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:57:05.134541+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.liferay.portal/release.dxp.bom/CVE-2020-15839.yml 38.6.0