Known Vulnerabilities

Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in...

Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay DXP allow remote...

Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay DXP allows remote attackers to inject arbitrary...

This issue was reported by foobar7 Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal and Liferay DXP allows remote authenticated attackers to...

Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s...

Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted...

Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Calendar's “Name”...

Severity 2 Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the server,...

Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the server, (3)...

Severity 2 Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the...

Liferay Portal 7.4.0 through 7.4.3.111 Liferay Portal 7.3.2 through 7.3.7 Liferay DXP 2023.Q4.0 through 2023.Q4.5 Liferay DXP 2023.Q3.1 through 2023.Q3.8 Liferay DXP 7.4 Liferay DXP 7.3 Liferay...

Liferay DXP 2023.Q3.6 This issue was reported by Erwin Krazek Severity 1 Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal and Liferay DXP allows...

Severity 2 The Account Settings page in Liferay Portal and Liferay DXP embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed...

Liferay Portal 7.4.3.38 Liferay Portal 7.4.3.38 Liferay DXP 7.4 update 38 Liferay DXP 7.3 update 11 Liferay DXP 7.2 fix pack 20 Liferay DXP 7.3 update 11 Liferay DXP 7.4 update 38 Liferay DXP 7.2...

Liferay DXP 7.3 update 8 Liferay DXP 7.4 update 27 Liferay DXP 7.2 fix pack 20 This issue was reported by Barnabás Horváth (T4r0) Severity 2 User enumeration vulnerability in Liferay Portal and...

Workaround: Set the following in portal(-ext).properties: http.header.version.verbosity=partial Liferay DXP 7.2 fix pack 19 Severity 2 In Liferay Portal and Liferay DXP the default value of the...

This issue was reported by: Sompo Digital Lab Tel Aviv, Asaf Guterman Severity 2 Privilege escalation vulnerability in Wiki in Liferay Portal and Liferay DXP allows remote authenticated users to...

Severity 1 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload...

Severity 2 The Image Uploader module in Liferay Portal and Liferay DXP relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to...

Severity 2 In Liferay Portal and Liferay DXP, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML...

Severity 2 HtmlUtil.escapeRedirect in Liferay Portal and Liferay DXP can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via...

Liferay Portal 7.4.0 through 7.4.3.18 Liferay Portal 7.3.0 through 7.3.7 Liferay Portal 7.2.0 and 7.2.1 Liferay Portal, older unsupported versions Liferay DXP 7.4 before update 19 Liferay DXP 7.3...

Liferay Portal 7.4.3.14 Liferay Portal 7.4.3.14 Liferay DXP 7.4 update 16 Liferay DXP 7.3 update 4 Liferay DXP 7.2 fix pack 17 Liferay DXP 7.3 update 4 Liferay DXP 7.4 update 16 Workaround: Set the...

Liferay DXP 7.3 update 12 Liferay DXP 7.4 update 4 Liferay DXP 7.2 fix pack 20 Severity 2 XXE vulnerability in Liferay Portal and Liferay DXP allows attackers with permission to deploy...

Liferay DXP 7.2 fix pack 17 Severity 2 The Journal module in Liferay Portal and Liferay DXP grants guest users view permission to web content templates by default, which allows remote attackers to...

Severity 2 Liferay Portal and Liferay DXP does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User...

Severity 2 Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML...

Severity 1 Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML...

Liferay DXP 7.3 update 34 Liferay DXP 2023.Q3.6 This issue was reported by Amin ACHOUR Severity 1 Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay...

Liferay DXP 2023.Q3.6 This issue was reported by Amin ACHOUR Severity 2 Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal and Liferay DXP allows remote...

Severity 2 Open redirect vulnerability in adaptive media administration page in Liferay DXP allows remote attackers to redirect users to arbitrary external URLs via the...

Severity 1 Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web...

Severity 1 Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary...

Severity 2 The IFrame widget in Liferay Portal and Liferay DXP does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self...

Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title`...

Severity 1 Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via...

Liferay DXP 7.4 update 41 through update 89 Liferay Portal 7.4.3.41 through 7.4.3.89 Liferay DXP 7.4 update 90 Liferay DXP 7.4 update 90 Liferay Portal 7.4.3.90 Liferay Portal 7.4.3.90 Severity 1...

Liferay DXP 7.3 update 24 Liferay DXP 7.3 update 24 Liferay DXP 7.4 update 79 Liferay Portal 7.4.3.79 Liferay Portal 7.4.3.79 Liferay DXP 7.4 update 79 Severity 2 Stored cross-site scripting (XSS)...

Liferay DXP 7.4 before update 54 Liferay Portal 7.4.2 through 7.4.3.53 Liferay DXP 7.4 update 54 Liferay DXP 7.4 update 54 Liferay Portal 7.4.3.54 Liferay Portal 7.4.3.54 Severity 2 Multiple stored...