CVE-2020-13444: 
Java vulnerability analysis and mitigation

Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 contains a vulnerability where the DDMDataProvider API does not properly sanitize returned information, potentially exposing sensitive data (CVE Database). The vulnerability was disclosed on June 10, 2020.

The vulnerability exists in the DDMDataProvider API implementation where insufficient sanitization of returned information could expose REST Data Provider passwords. The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium) and a CVSS v2.0 score of 4.0 (Medium) (NVD Database).

When successfully exploited, this vulnerability allows remote authenticated users to obtain passwords to REST Data Providers, potentially leading to unauthorized access to connected data services (CVE Database).

The vulnerability requires authentication for exploitation, indicating a somewhat limited attack scope. The attacker must have valid credentials to access the system before attempting to exploit this vulnerability (NVD Database).

Organizations should upgrade to Liferay Portal 7.3.2 or later. For Liferay DXP users, the following fixes are available: DXP 7.0 users should install fix pack 92 or later, DXP 7.1 users should install fix pack 18 or later, and DXP 7.2 users should install fix pack 5 or later (CVE Database).