Known Vulnerabilities

Liferay Portal 7.3.1 Liferay Portal 7.3.1 May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. There is no fix...

Cross-site scripting (XSS) vulnerability in the asset module in Liferay Portal 7.0.0 through 7.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1)...

Severity 2 Cross-site scripting (XSS) vulnerability in document library module in Liferay Portal 7.3.0 through 7.3.4 allow remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal 7.3.5 Liferay Portal 7.3.5 May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. Severity 2...

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by...

Severity 2 Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the title of a...

Severity 2 Liferay Portal 7.3.4 May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. Liferay Portal 7.3.4 The...

Severity 2 Cross-site scripting (XSS) vulnerability in Web Content Display in Liferay Portal 7.1.1 through 7.3.3 allows remote attackers to inject arbitrary web script or HTML via web content...

Cross-site scripting (XSS) vulnerability in the journal module in Liferay Portal 7.3.0 through 7.3.3 allows remote attackers to inject arbitrary web script or HTML via the...

Severity 2 The Portal Workflow module in Liferay Portal 7.3.2 and earlier, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions...

Liferay Portal 7.3.3 This issue was reported by Prajwal Khante Liferay Portal 7.2.0 through 7.3.2 allows access to Cross-origin resource sharing (CORS) protected resources if the user is only...

Severity 2 Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1 allows remote attackers to redirect users to arbitrary external URLs via the 'redirect'...

Severity 2 The Flags module in Liferay Portal 7.3.1 and earlier does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site...

Liferay Portal 7.3.3 May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. There is no fix available for Liferay...

Severity 2 The Layout module in Liferay Portal 7.1.0 through 7.3.1 does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the...

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4 and 7.3.5 allow remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal 7.3.6 Liferay Portal 7.3.6 May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. Severity 2...

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5 allows remote attackers to inject arbitrary web script or...

Severity 2 The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle...

Severity 2 Liferay Portal 7.3.6 Liferay Portal 7.3.6 Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 allows remote attackers to...

Severity 2 Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5 allows remote attackers to inject arbitrary web...

Severity 2 The SimpleCaptcha implementation in Liferay Portal 7.3.4 and 7.3.5 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions...

The JSON web services in Liferay Portal 7.3.4 and earlier, the JSON web service may contain overly verbose error messages, which allows remote attackers to use the contents of error messages to...

Liferay Portal 7.3.6 Liferay Portal 7.3.6 Severity 2 The Data Engine module in Liferay Portal 7.3.0 through 7.3.5 does not check permissions in DataDefinitionResourceImpl....

The redirect module in Liferay Portal 7.3.2 does not limit the number of URLs that result in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by...

Severity 1 Liferay Portal before 7.3.3 does not restrict the size of ‘multipart/form-data’ encoded form post, which allows remote authenticated users to conduct denial-of-service attacks by...

Liferay Portal 7.3.3 September 2020 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. Liferay Portal 7.3.3 Cross-site...

Severity 2 Liferay Portal before 7.3.3 does not properly restrict access to the sitemap.xml of staged public pages, which allows remote attackers to access sitemap.xml and learn of the existence...

The Calendar widget records views by unauthenticated users in Liferay Portal 7.2.0 through 7.3.0, which allows remote attackers who view a Calendar widget to prevent changes to Instance Settings...

Liferay Portal 7.3.1 Liferay Portal 7.3.1 September 2020 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. Severity 2...

Some issues reported by Arun Das Severity 2 Liferay Portal 7.2.1, 7.3.2 and possibly earlier unsupported versions includes the following libraries which have known vulnerabilities: Netty 4.1.42...

In Liferay Portal before 7.3.3, an administrator can limit the type of images that can be used as a blog cover image. However, this protection can be circumvented via HTTP manipulation to upload...

Severity 2 Multiple cross-site scripting (XSS) vulnerabilities in the fragment module in Liferay Portal 7.1.0 through 7.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1)...

Liferay Portal 7.3.3 The login module in Liferay Portal before 7.3.3 will indicate whether an email address or screen name is in the system or not, which allows remote attackers to enumerate users...

Severity 1 Liferay Portal before 7.3.1 does not decode a URL before determining if the resource should be served, which allows remote attackers to access restricted portlet resources (e.g., files...

The staging module in Liferay Portal before 7.3.2 does not properly check user permission, which allows remote authenticated users to delete a publishing process via the staging menu. Severity 2...

Liferay Portal 7.3.1 Liferay Portal 7.3.1 Severity 2 Liferay Portal 7.3.0 does not properly check user permissions, which allows remote authenticated users to view user groups that are members of a...

Liferay Portal 7.3.0 and 7.3.1 includes the following libraries which have known vulnerabilities: Apache POI 4.1.0 Severity 2 Liferay Portal 7.3.2 Liferay Portal 7.3.2

Severity 2 Cross-site scripting (XSS) vulnerability in the portal workflow module in Liferay Portal 7.3.0 allows remote attackers to inject arbitrary web script or HTML via the user name parameter....

Liferay Portal 7.3.1 Liferay Portal 7.3.1 June 2020 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page. June 2020 source...

Severity 1 In Liferay Portal before 7.3.2, the template API does not restrict user access to to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted...

Severity 1 Liferay Portal 7.x before 7.3.2, does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data...