Known Vulnerabilities

Severity 1 Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML...

Liferay DXP 7.3 update 34 Liferay DXP 2023.Q3.6 This issue was reported by Amin ACHOUR Severity 1 Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay...

Liferay DXP 2023.Q3.6 This issue was reported by Amin ACHOUR Severity 2 Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal and Liferay DXP allows remote...

Severity 1 Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web...

Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web script or HTML via...

Severity 1 Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web...

Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the filename of an...

Liferay Portal 7.4.0 through 7.4.2 Liferay Portal 7.3.0 through 7.3.7 Liferay Portal 7.2.0 and 7.2.1 Liferay Portal, older unsupported versions Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2...

Liferay DXP 7.3 update 4 Liferay Portal 7.4.3.4 Liferay DXP 7.2 fix pack 19 This issue was reported by Sahil Mehra Information disclosure vulnerability in the Control Panel in Liferay Portal and...

Severity 2 Liferay Portal and Liferay DXP does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote...

Liferay Portal 7.4.0 and 7.4.1 Liferay Portal 7.3.0 through 7.3.7 Liferay Portal 7.2.0 and 7.2.1 Liferay Portal, older unsupported versions Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2...

Liferay DXP 7.3 service pack 3 Liferay Portal 7.4.2 Liferay DXP 7.2 fix pack 15 Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal and Liferay DXP allows remote...

Severity 2 Liferay Portal and Liferay DXP returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote...

Severity 1 Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary...

Severity 2 The IFrame widget in Liferay Portal and Liferay DXP does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self...

Severity 1 Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via...

Liferay DXP 7.4 update 41 through update 89 Liferay Portal 7.4.3.41 through 7.4.3.89 Liferay DXP 7.4 update 90 Liferay DXP 7.4 update 90 Liferay Portal 7.4.3.90 Liferay Portal 7.4.3.90 Severity 1...

Liferay DXP 7.3 update 24 Liferay DXP 7.3 update 24 Liferay DXP 7.4 update 79 Liferay Portal 7.4.3.79 Liferay Portal 7.4.3.79 Liferay DXP 7.4 update 79 Severity 2 Stored cross-site scripting (XSS)...

Liferay DXP 7.4 before update 54 Liferay Portal 7.4.2 through 7.4.3.53 Liferay DXP 7.4 update 54 Liferay DXP 7.4 update 54 Liferay Portal 7.4.3.54 Liferay Portal 7.4.3.54 Severity 2 Multiple stored...

Liferay Portal 7.4.3.92 This issue was reported by Michael Oelke Severity 1 Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal and Liferay DXP allow...