Known Vulnerabilities

Liferay Portal 7.1.3 and possibly earlier unsupported versions, is bundled with with Jackson Databind 2.9.8 which contains known vulnerabilities. Severity 2 March 2020 source patch for Liferay...

March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay Portal 7.1.3 and possibly earlier unsupported...

Insecure default configuration in Liferay Portal 7.2.0 and earlier allows man-in-the-middle attackers to intercept the email sent to users when their account is created and login as the user.  ...

In Liferay Portal 7.1.3 and possibly earlier unsupported versions, the 'com.liferay.frontend.js.lodash.web' bundle includes Lodash 4.17.4 which has known vulnerabilities. Severity 2 March 2020...

Liferay Portal 7.0.0 through 7.0.6 does not properly verify permission when creating pages which may lead to attackers changing portal settings and gaining access to sensitive information. Severity...

Liferay Portal 7.1.0 and earlier is vulnerable to denial-of-service (DoS) attacks via file uploads because of vulnerabilities in Apache Tika. Severity 1 Liferay Portal 7.1.1 March 2020 source patch...

Liferay Portal 7.2.1 March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay Portal 7.2.0 and earlier,...

Liferay Portal 7.0.3 March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. The RSS portlet and FuseMail...

Liferay Portal 6.2.5 and earlier does not properly check permissions, which allows remote authenticated users to impersonate, edit, or delete administrators. Workaround: Remove the User.DELETE,...

Remote code execution vulnerability in DDM template in Liferay Portal 7.0.0 and earlier allows remote authenticated users with permission to create/edit templates to create templates that can run...

Denial-of-service (DoS) vulnerability in document library in Liferay Portal 6.2.5 and earlier allows remote attackers to cause an OutOfMemoryError by uploading a crafted PDF file. Workaround: Use...

Remote file disclosure vulnerability in DDM templates in Liferay Portal 6.2.5 and earlier allows remote authenticated users with permission create/edit templates to view any files that are readable...

March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. The IFrame portlet in Liferay Portal 6.2.5 and earlier...

Server side request forgery (SSRF) vulnerability in pingback functionality of blogs in Liferay Portal before 7.1.0 allows remote attackers to send HTTP requests to intranet servers and conduct...

Liferay Portal 7.0.1 March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. Review permissions settings and do...

The BaseBSFPortlet class contains a path traversal vulnerability via URL manipulation. Liferay Portal 7.0 CE does not use the BaseBSFPortlet class out of the box. However, developers extending...

In Liferay Portal 7.1 CE GA4 and possibly earlier unsupported versions, the LDAP credentials are transmitted in plain text. Severity 2 March 2020 source patch for Liferay Portal 7.1.3. Details for...

Liferay Portal 7.1 CE GA4 and possibly earlier unsupported versions, the 'X-Forwarded-Host' HTTP header can be used to bypass the whitelisted hosts provided in the portal property...

Liferay Portal 7.1.3 and earlier is vulnerable to remote code execution via deserialization of JSON data. Severity 1 March 2020 source patch for Liferay Portal 7.1.3. Details for working with...

March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. The open redirect protection component in Liferay Portal...

In Liferay Portal 7.1 CE GA4 and possibly earlier unsupported versions, the user's password is visible on the screen immediately after the account creation process. Severity 2 March 2020 source...

In Liferay Portal 7.1 CE GA4 and earlier, a potential SQL injection vulnerability exist in the asset framework. Severity 1 March 2020 source patch for Liferay Portal 7.1.3. Details for working with...

March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. Liferay Portal 7.1 CE GA4 and possibly earlier...

In Liferay Portal 7.1 CE GA4 and possibly earlier unsupported versions, users may be tricked into creating an account with an OpenID provider. If the OpenID provider is not trustworthy, an attacker...

In Liferay Portal 7.1 CE GA4, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 March 2020 source patch for...

Liferay Portal 7.1 GA1 and possibly earlier unsupported versions truncates the regular expression field in a password policy. This may result in users using passwords which they should not use....

Multiple permission issue exists in Liferay Portal 7.1 CE GA4 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 March 2020 source patch for...

March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay 7.1.0 through 7.1.3, unauthorized users can...

In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the Sign In widget may expose the user's email address and/or password in the page's HTML source. This may allow a third...

In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the search results from the Search Bar widget uses links that redirect users to HTTP instead of HTTPS. Severity 2 Liferay...

In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the 'com.liferay.map.openstreetmap' bundle loads the npm package, leaflet, using HTTP instead of HTTPS. Severity 2 Liferay...

In Liferay Portal 7.2 CE GA1 and possibly earlier unsupported versions, an open redirect vulnerability exists in Account Settings. Severity 2 Liferay Portal 7.2.1

Liferay Portal 7.2.1 March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay Portal 7.1 CE GA4, 7.2 CE...

In Liferay Portal 7.2.0 and earlier contains a remote code execution (RCE) vulnerability via JSON web services (JSONWS).   Workaround: Disable JSONWS by setting the portal.property...

In Liferay Portal 7.1 CE GA4, 7.2 CE GA1 and possibly earlier unsupported versions, the /user/send-password-by-* JSONWS APIs can be used in a denial-of-service attack on the mail server. Severity 2...

Liferay Portal 7.2.1 Some vulnerabilities reported by Arun Liferay Portal 7.2 CE GA1 includes the following libraries which have known vulnerabilities: Apache Commons BeanUtils 1.9.2 Apache Tika...

Multiple permission issue exists in Liferay Portal 7.2 CE GA1 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.2.1 Some...

In Liferay Portal 7.2 CE GA1, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal 7.2.1

Liferay Faces Alloy 2.0.2 (source) Liferay Faces Alloy 3.0.2 (source) To install, remove any old versions of Liferay Faces Alloy and place the fixed version of Liferay Faces Alloy in the...

A stored cross-site scripting (XSS) vulnerability exists in alloy:autoComplete and alloy:inputFile due to improper rendering of JavaScript strings in arrays for the following versions of Liferay...

Binary patch (source) To install, place patch in each of your Liferay Faces WARs in the WEB-INF/lib directory. The dependency can be included via Maven, Gradle, or Ivy. In a Maven project pom.xml...

Liferay Portal 7.1.1 March 2020 source patch for Liferay Portal 7.0.6. Details for working with source patches can be found on the Patching Liferay Portal page. March 2020 source patch for Liferay...

Liferay Portal 7.1.3 When defining permissions for a role in Liferay Portal 7.1 CE GA3 and older unsupported versions, some permissions may be selected by default. This may unintentionally lead to...

In Liferay Portal 7.1 CE GA3 and older unsupported versions, an open redirect vulnerability exist in the Language Selector widget. Severity 2 Liferay Portal 7.1.3

In Liferay Portal 7.1 CE GA3 and older unsupported versions, a path traversal vulnerability exists in poller. Severity 2 Liferay Portal 7.1.3

Liferay Portal 7.1 CE GA3 includes the following libraries which have known vulnerabilities: Apache Batik 1.7 Apache HttpClient 4.1 Apache PDFBox 2.0.9 Apache Tika 1.18 c3p0 0.9.5.2 Ehcache 2.8.3...

In Liferay Portal 7.1 CE GA3, multiple cross-site scripting (XSS) vulnerabilities exists which allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal...

Liferay Portal 7.1 CE GA3 and older unsupported versions and older unsupported versions is vulnerable to Server-Side Request Forgery (SSRF) via DDM REST Data Provider which allows an attacker...

Liferay Portal 7.1.3 In Liferay Portal 7.1 CE GA3 and older unsupported versions, Message Boards post that are marked as "Anonymous" can be associated with the user who posted it. This issue exists...

In Liferay Portal 7.1 CE GA3 and older unsupported versions, a company's secret key is accessible via templates. Severity 2 Liferay Portal 7.1.3

In Liferay Portal 7.1 CE GA3 and older unsupported versions, user password hashes and password reminder answers may be appear in the logs if a database error occurs. Severity 2 Liferay Portal 7.1.3

Multiple permission issue exists in Liferay Portal 7.1 CE GA3 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.1.3

Liferay Portal 7.1.2 Message boards post that are marked as "Anonymous" can be associated with the user who posted it. Severity 2

An open redirect vulnerability exist in Liferay Portal 7.1 CE with the <liferay-ui:header> tag. Severity 2 Liferay Portal 7.1.2

In Liferay Portal 7.1 CE, an unexpected error may produce an overly verbose error message that is visible to end users. Severity 2 Liferay Portal 7.1.2

User login in Liferay Portal 7.1 CE is vulnerable to Cross-Site Request Forgery (CSRF) attacks. Severity 2 Liferay Portal 7.1.2

A bug in Liferay Portal CE 7.1 CE allows any authenticated user to change the password of another user, including an administrator. Once a user has access to an administrator account, a full system...

Liferay Portal 7.1.2 Multiple permission issue exists in Liferay Portal 7.1 CE GA2 which allows users to perform actions on resources which they are not authorized to perform. Severity 2

A stored cross-site scripting (XSS) vulnerability exits with the image resolution information in Adaptive Media in Liferay CE 7.1 GA2. Severity 2 Liferay Portal 7.1.2

Liferay Portal 7.1.0 and earlier is vulnerable to remote code execution (RCE) via deserialization of JSON data. Severity 1 Liferay Portal 7.1.1 March 2020 source patch for Liferay Portal 7.0.6....