Known Vulnerabilities

Editing a blog entry may reset the blog entry's permission to the default permission. This may allow a user without the necessary permission to view a blog entry. Severity 2 Liferay Portal 7.0.2

Liferay Portal 7.0.2 The search result in the Search portlet may include search results which a user does not have permission to view. Severity 2

The portal is vulnerable to open redirects for certain types of URLs. An attacker can potentially exploit this security vulnerability to mislead a user to different website. Severity 2 Liferay...

This ticket covers various inline JavaScript related cross-site scripting (XSS) vulnerability. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a...

A reflected cross-site scripting (XSS) vulnerability exist in the <aui:form> tag. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page....

A reflected cross-site scripting (XSS) vulnerability exist in the <aui:form> tag. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page....

Liferay Portal 7.0.2 A stored cross-site scripting (XSS) vulnerability exist in Monitoring. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a...

By default, Liferay Portal gives every registered user the Power User role. When a signed in user has the Power User role, the user will have their own site and permissions to manage the site...

Cross-Site Request Forgery (CSRF) tokens are persisted in the database and may make it easier for an attacker to launch a CSRF attack. Severity 2 Liferay Portal 7.0.1

Liferay Portal 7.0.1 An open redirect vulnerability exists with Facebook authentication. An attacker can potentially exploit this security vulnerability to redirect users to a different site....

By constructing the correct URL, some restricted Web Application Bundle (WAB) resources may be accessible. Severity 2 Liferay Portal 7.0.1

This ticket covers various permission issues in Liferay Portal 7.0 CE GA1 that may result in a user having permission the user should not have. Severity 1 Liferay Portal 7.0.1

This ticket covers various cross-site scripting (XSS) issues in Liferay Portal 7.0 CE GA1 Severity 2 Liferay Portal 7.0.1

Velocity and FreeMarker templates are vulnerable to remote code execution (RCE) and privilege escalation. Severity 1 Note that there are two binary patches which fix this issue, as well as all...

Password policies can be configured to lock out a user after a specified number of failed login attempts. However, if a user is using digest authentication, this lock out can be circumvented....

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

An open redirect vulnerability exists may be possible with some specially constructed domain names. An attacker can potentially exploit this security vulnerability to redirect users to a different...

A vulnerability known as "Java Deserialization Vulnerability" was discovered and Liferay Portal is potential vulnerable in the following locations: TunnelServlet: Spring-Remoting services By...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

This ticket covers various permission issues in Liferay Portal 6.2 CE GA6 that may result in a user having permission the user should not have. Severity 2 Note that there are two binary patches...

XSL Content portlet can be configured with any XML/XSL. The XSL Content portlet allows anyone who has permission to configure the portlet to specify any XML/XSL file. By creating the appropriate...

Flash does not strictly honor the same-origin policy. As a result, if an attacker is able to upload a malicious flash file to portal, the flash file can be used to circumvent the portal's CSRF...

The version of openid4java.jar that is currently used by the portal vulnerable to XXE attack. Severity 2 Note that there are two binary patches which fix this issue, as well as all previous CST...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

The MailEngine API is vulnerable to email header injection. This issue only affects users who are calling the MailEngine directly. Severity 3 Note that there are two binary patches which fix this...

This ticket covers various permission issues in Liferay Portal 6.2 CE GA3 that may result in a user having permission the user should not have. Severity 2 Note that there are two binary patches...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

The default GenericPortlet implementation is vulnerable to denial-of-service (DoS) attacks and information leak (CVE-2015-1926). As a part of this fix, the JSR 286 Specification JAR (portlet.jar)...

This ticket covers various cross-site scripting (XSS) issues in Liferay Portal 6.2 CE GA3 that are addressed by the CST patch. LPS-55962 Incorrect escaping in liferay-ui:app-view-search-entry...

Due to a requirement in Section 4.2.5 of the JSR 329 Specification, CVE-2015-5176 exists in the Liferay Faces Bridge API dependency. For more information about patch availability, see the blog...

LPS-44182 Reflected XSS in edit layout LPS-44196 Stored XSS in Asset Publisher and WCM Display portlets via OpenOffice conversion file extensions LPS-44197 Reflected XSS in *Directory portlets...

This issue was reported by Tomas Polesovsky A zero-day security vulnerability in the ActionForms object in Struts 1.x allows remote attackers to manipulate the class loader. In some environments,...

6.2.1-ce-ga2-security-2.0 patch (source) A zero-day security vulnerability in the ActionForms object in Struts 1.x allows remote attackers to manipulate the class loader. In some environments, this...

LPS-43278 XSS in Message Boards LPS-43476 Stored XSS in Shopping portlet LPS-43653 Various XSS in Layouts admin portlet LPS-43660 Stored XSS in QuickNote LPS-42795 XSS issue in shopping portlet ...

A security vulnerability in the Apache Commons FileUpload before 1.3.1 allows remote attackers to cause a denial of service by manipulating the request header. In addition to patching Liferay...

This issue was reported by Christian Schneider The portal is vulnerable to XML external entity (XXE) processing in 6.2.2. This can lead to disclosure of confidential data or a denial-of-service...

Note that there are two binary patches which fix both LPS-51061 (this report) and LPS-51094, as well as all previous CST fixes for this release. You only need to apply one of these, not both....

The forgot password feature in the Sign In portlet allows e-mail address in the portal to be enumerated. Workaround: Disable forgot password emails Severity 3 Note that there are two binary patches...

This ticket covers various permission checking issues in Liferay Portal 6.2 CE GA3 that are addressed by the CST patch, including: Permissions are not correctly checked when creating folders in...

This fix covers various XSS issues uncovered in Liferay applications shipped with Liferay Portal CE 6.2 GA2 (6.2.1). This issue also resolves CERT VU#100972 Severity 2 6.2.1-ce-ga2-security-3.0...

This issue fixes several XSS issues in 6.2.2: User profile, Message Boards, portlet.vm, and control panel. Severity 2 Note that there are two binary patches which fix both LPS-51061 (this report)...

This fix addresses two vulnerabilities which allow a guest user to obtain a list of the sites and workflow definition in the portal by manipulating the URL. The user can only view the name of the...

This issue was discovered and reported by Bob Brinks This ticket resolves two unvalidated redirects, one related to the Document and Media portlet one related to CAS, that may be used in a phishing...

The portal is vulnerable to HTTP host header attacks. This vulnerability can be used for web cache poisoning or for password reset poisoning. Severity 1 Note that there are two binary patches which...

This fix groups several minor XSS issues discovered in Liferay Portal 6.2.0 in to a single CST patch. The following fixes are included: LPS-43095 - XSS issue in DDL - ability to inject script into...

Note that there are two binary patches which fix both LPS-51094 (this report) and LPS-51061 (as well as all previous CST fixes). You only need to apply one of these, not both. Binary Patch 1: The...