Known Vulnerabilities

Liferay Portal 7.1.0 and earlier contains a path traversal vulnerability in Web Content templates and Application Display Templates (ADT). The vulnerability allows any user with permission to...

The password reset token may be leaked to 3rd party website in Liferay Portal 7.1 CE. Out of the box, the password reset token is not leaked to any 3rd party website. However, if the site is...

The default configuration for Liferay Portal 7.0.0 through 7.1.0 allow attackers to conduct XML External Entity (XXE) attacks via XSL templates in XSL Content and Web Content. Workaround: 1....

Liferay Portal 7.1.1 In Liferay Portal 7.1 CE GA1, users are normally required to enter their current password if they want to change their password. However, the requirement to enter the current...

Notification emails sent to users in Liferay Portal 7.1 CE GA1 is vulnerable to HTML injection. An attacker can exploit this vulnerability for phishing attacks. Severity 2 Liferay Portal 7.1.1

Liferay Portal 7.1.0 and earlier is vulnerable to a Server-Side Request Forgery (SSRF) via Web Content templates and Application Display Templates (ADT) which may allow an attacker access to...

Liferay Portal 7.1.1 An LDAP injection vulnerability exits in Liferay 7.1 CE GA1 with user group names. Severity 2

Multiple permission issue exists in Liferay Portal 7.1 CE GA1 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.1.1

In Liferay Portal 7.1 CE GA1, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal 7.1.1 Some...

This issue was reported by Tiago Sintra An open redirect vulnerability exits with Blogs RSS and tunnel-web in Liferay Portal 7.1 CE GA1. Severity 2 Liferay Portal 7.1.1

In Liferay Portal 7.1 CE GA1, other sessions are not terminated when a user changes their password. Severity 2 Liferay Portal 7.1.1 This issue was reported by Osama Mahmood

In LIferay Portal 7.0 CE GA7, a theoretical OS command injection vulnerability exists in SendmailHook. Severity 2 Liferay Portal 7.1.0 7.0.6-ce-ga7-security-1.0 patch (source) By default, the...

This issue was reported by Juho Myllys The CSV files that are exported by Liferay Portal 7.0 CE GA7 (user export, DDL export and Form export) is susceptible to CSV injection if the CSV file is...

In Liferay Portal 7.0 CE GA7, A cross-site request forgery (CSRF) vulnerability exist with comments. An attacker can potentially exploit this security vulnerability to add comments on behalf of a...

Liferay Portal 7.1.0 7.0.6-ce-ga7-security-1.0 patch (source) In Liferay Portal 7.0 CE GA7, the password for a Form's REST data provider does not obfuscate the password leading to password...

In Liferay Portal 7.0 CE GA7, a flaw in the code used to prevent open redirects allows some crafted URLs to circumvent the open redirect prevention logic. Severity 2 Liferay Portal 7.1.0...

In Liferay Portal 7.0 CE GA7, blogs titles are visible to users without the appropriate view permission. Only the title is leaked and the user cannot view the content of the blog entry. Severity 2...

Liferay Portal 7.1.0 7.0.6-ce-ga7-security-1.0 patch (source) Some vulnerabilities reported by Gergő Czuczor In Liferay Portal 7.0 CE GA7, multiple cross-site scripting (XSS) vulnerabilities allow...

Multiple cross-site request forgery (CSRF) vulnerabilities allow remote attackers to execute unwanted actions in the portal. Workaround: Remove the following lines from the...

In Liferay Portal 7.0.5 and earlier, the Web Proxy portlet/application allows remote attackers to execute arbitrary code via supplied stylesheet. Patched versions of the portal will prevent users...

The portal may be vulnerable to BREACH attacks if the portal is using HTTPS and compression (GZip) is enabled. Workaround: Disable compression by setting...

The "doAsUserId" parameter used by Administrators for impersonating another user can be leaked to third party sites. Severity 2 Liferay Portal 7.0.6

Liferay Portal 7.0.6 The asset tag API leaks information about the user who created the asset tag. Severity 2

Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.0.6

A reflected cross-site scripting (XSS) vulnerability exist on the JSONWS API page. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page....

Liferay Portal 7.0.5 Apache Commons Email is vulnerable to SMTP header injection (CVE-2017-9801). Liferay Portal is not vulnerable, however, custom modules/apps using the Commons Email JAR bundled...

Content spoofing is possible via URL manipulation in applications that suppor tags. An attacker can potentially exploit this security vulnerability to spoof content and mislead users. Severity 2...

All files within the application's WAR folder is accessible via crafted URL. Severity 1 Liferay Portal 7.0.5

This issue was reported by Tomas Bortoli Open redirect vulnerability in the Asset Publisher application allows remote attackers to redirect users to arbitrary web sites. Severity 2 Liferay Portal...

Unauthenticated users can modify system settings to gain administration privileges. Severity 1 Liferay Portal 7.0.5

Liferay Portal 7.0.5 March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay Portal 7.0.4 and earlier,...

Passwords are visible to administrators in the System Settings section of the Control Panel. Severity 2 Liferay Portal 7.0.5

Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.0.5

Liferay Portal 7.0.5 Some vulnerabilities reported by Marko Winkler Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page....

In a shared environment (e.g., a computer at a library or internet cafe), a user's reminder query answer may be accessible by another user. Severity 2 Liferay Portal 7.0.4

User's email address, screen name or user id (depending on the authentication method) is exposed in URL. Severity 2 Liferay Portal 7.0.4

Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.0.4

Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal 7.0.4

7.0.3-ce-ga4-security-1.0 patch (source) In Liferay Portal 7.0 CE GA4, the path to all OSGi bundles is exposed via crafted URL. Severity 1

In Liferay Portal 7.0 CE GA3, Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary...

In Liferay Portal 7.0 CE GA4, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 7.0.3-ce-ga4-security-1.0...

7.0.3-ce-ga4-security-1.0 patch (source) March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay...

In Liferay Portal 7.0 CE GA4, AggregateFilter, MinifierFilter and DynamicCSSFilter allows unauthenticated users to cause a denial of service (disk consumption) via crafted URL. Severity 1...

Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal 7.0.0 This issue was reported by Marko Winkler

Liferay Portal 7.0.0 User credentials may appear in the logs if the user authenticates using basic authentication. Severity 2

Insufficient permission checking in Message Board and Comments allows unauthorized users to edit and/or delete other user's messages or comments. Severity 2 Liferay Portal 7.0.0 This issue was...

Users without the necessary permssion can view page configuration information the via crafted URLs. Severity 2 Liferay Portal 7.0.0 This issue was reported by Spyridon Chatzimichail

When JAAS is enabled, ThreadLocal may leak variables to other processes. Severity 2 Liferay Portal 7.0.3

Passwords are visible to administrators in the Server Administration section of the Control Panel. Severity 2 Liferay Portal 7.0.3

System settings (including credentials/passwords) may be exposed when performing a data migration. The information exposure is limited to the administrator user who executed the data migration....

Liferay Portal 7.0.3 Some vulnerabilities reported by Spyridon Chatzimichail Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Severity 2

The password history checking functionality in a password policy can be circumvented via forget password. Severity 2 Liferay Portal 7.0.3

Open redirect vulnerability in Search application allows remote attackers to redirect users to arbitrary web sites. Severity 2 Liferay Portal 7.0.3

Liferay Portal 7.0.3 March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. Apache Commons FileUpload, as used...

Apache Tika is vulnerable to XML External Entity (XXE) processing attacks. This vulnerability can allow an attacker to access files on the file system and/or take down the portal (denial of...

Unsanitized data in SessionClicks allows an attacker to cause a denial-of-service (DoS) via crafted URLs. The denial-of-service is limited to users who have clicked on the crafted URL and may...

Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal 7.0.3 Some vulnerabilities reported by Craig...

This issue was reported by Jacob Baines TunnelServlet allows remote code execution by unauthenticated users. Severity 1 Liferay Portal 7.0.3

Liferay Portal 7.0.2 If the log level is set to DEBUG, LDAP credentials are exposed in the logs. Severity 2

In Liferay Portal 7.0.1 and earlier, PDFBox does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF....