Known Vulnerabilities

Liferay DXP 7.4 update 51 Liferay Portal 7.4.3.51 Liferay DXP 7.4 update 50 Liferay Portal 7.4.3.50 Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in...

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal and Liferay DXP allow remote attackers to inject...

Liferay DXP 7.4 before update 31 Liferay Portal 7.4.0 - 7.4.3.30 Liferay DXP 7.4 update 31 Liferay Portal 7.4.3.31 Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay...

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

Severity 2 Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script...

Severity 1 The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4 includes the LDAP credential in the page URL when paginating through the list of users, which allows...

Liferay Portal 7.4.3.4 The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.2 does not validate HTTPS certificates used with DDMRESTDataProvider, which allows man-in-the-middle...

Severity 2 The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4 does not properly check permission of form entries, which allows remote authenticated users to view and access all...

Insecure direct object reference vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4 allows remote authenticated users to view and access form entries via the...

Liferay Portal 7.4.3.5 Liferay Portal 7.4.3.5 Severity 2 The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 does not properly check permissions, which allows remote attackers...

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 does not properly check user permission, which allows remote attackers to obtain the history of all friendly URLs that was...

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the...

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious...

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 allows remote attackers to consume an excessive amount of server resources via a crafted payload...

Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18 allows attackers to create or overwrite existing files on the filesystem via the installation of a...

SQL injection vulnerability in the Layout module's page template upgrade process in Liferay Portal 7.1.3 through 7.4.3.4 allows remote authenticated attackers to execute arbitrary SQL commands via...

SQL injection vulnerability in the Fragment module's PortletPreferences upgrade process in Liferay Portal 7.3.3 through 7.4.3.16 allows attackers to execute arbitrary SQL commands via a...

Liferay Portal 7.4.3.4 There is no fix available for Liferay Portal 7.3. Please upgrade to Liferay Portal 7.4. This issue was reported by Duy Huynh Cross-site scripting (XSS) vulnerability in the...

Cross-site scripting (XSS) vulnerability in the Portal Search module's Tag Facet widget in Liferay Portal 7.1.0 through 7.4.2 allows remote attackers to inject arbitrary web script or HTML via the...

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module's <clay:label> tag in Liferay Portal 7.3.2 through 7.4.3.16 allows remote attackers to inject arbitrary web script or HTML via...

Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14 allows remote attackers to inject arbitrary web script or...

Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML...

Liferay Portal 7.4.0 - 7.4.3.36 Liferay Portal 7.4.3.37 Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36 allows remote...

Cross-site scripting (XSS) vulnerability in Document Library module's move file interface in Liferay Portal 7.4.3.30 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML...

Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24 allows remote attackers to inject arbitrary web script or HTML via a...

Liferay Portal 7.4.3.4 There is no fix available for Liferay Portal 7.2 and 7.3. Please upgrade to Liferay Portal 7.4. Cross-site scripting (XSS) vulnerability in the Sharing module's user...

Cross-site scripting (XSS) vulnerability in the Announcements module's Announcement and Alerts management page in Liferay Portal 7.1.0 through 7.4.2 allows remote attackers to inject arbitrary web...

This issue was reported by Rafal Lykowski, A1 Digital International Cross-site scripting (XSS) vulnerability in the Document Library module in Liferay Portal 7.3.5 through 7.4.3.28 allows remote...

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector input field in Liferay Portal 7.3.0 through 7.4.2 allows remote attackers to inject arbitrary web script or...

The Layout module in Liferay Portal 7.3.3 through 7.4.3.34 does not check user permission before showing the preview of a "Content Page" type page, which allows remote attackers to view unpublished...

Liferay Portal 7.4.3.12 - 7.4.3.36 Liferay Portal 7.4.3.37 The Translation module in Liferay Portal 7.4.3.12 through 7.4.3.36 does not check permissions before allowing a user to export a web...

Liferay Portal 7.4.3.9 This issue was reported by Jakub Zoczek, Securitum The Remote App module in Liferay Portal 7.4.3.4 through 7.4.3.8 does not check if the origin of event messages it receives...

The portal property, auth.login.prompt.enabled defaults to true in Liferay Portal 7.0.0 through 7.4.2 which allows attackers to enumerate and discover the existence of screen names, site names, and...

Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of...

Liferay Portal 7.4.2 Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the...

Cross-site scripting (XSS) vulnerability in the Fragment modules in Liferay Portal 7.4.3.4 allows remote attackers to inject arbitrary web script or HTML via parameters with a `filter_` prefix....

Liferay Portal 7.4.3.4 January 2022 source patch for Liferay Portal 7.3.7. Details for working with source patches can be found on the Patching Liferay Portal page. There is no fix available for...

Cross-site scripting (XSS) vulnerability in the <liferay-asset:asset-tags-selector> tag in Liferay Portal 7.3.3 through 7.4.2 allows remote attackers to inject arbitrary web script or HTML via the...

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1 allows remote attackers to inject arbitrary web script...

HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via...