Known Vulnerabilities

Liferay Portal 7.4.3.112 Liferay Portal 7.4.3.112 Liferay DXP 2024.Q1.1 Liferay DXP 2024.Q1.1 Blogs in Liferay Portal and Liferay DXP does not check permission of images in a blog entry, which...

The Document Library and the Adaptive Media modules in Liferay Portal and Liferay DXP uses an incorrect cache-control header, which allows local users to obtain access to downloaded files via the...

Liferay Portal 7.4.3.35 through 7.4.3.111 Liferay DXP 2023.Q4.0 through 2023.Q4.10 Liferay DXP 2023.Q3.1 through 2023.Q3.10 Liferay DXP 7.4 U35 through U92 Liferay Portal 7.4.3.112 Liferay Portal...

Liferay DXP 2024.Q1.1 This issue was reported by argon21 Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal and Liferay DXP allows remote attackers to...

By default, Liferay Portal and Liferay DXP is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by...

Password enumeration vulnerability in Liferay Portal and Liferay DXP allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack. Liferay...

CSRF vulnerability in Headless API in Liferay Portal and Liferay DXP allows remote attackers to execute any Headless API via the `endpoint` parameter. Liferay Portal 7.4.0 through 7.4.3.107 Liferay...

Liferay Portal and Liferay DXP does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application...

Liferay Portal and Liferay DXP stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s...

Liferay Portal 7.0.0 through 7.4.3.97 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Liferay DXP 7.3 GA through U35 And older unsupported versions Liferay Portal 7.4.3.98 Liferay Portal...

Liferay Portal 7.4.3.104 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.0 Liferay DXP 2023.Q3.5 Liferay Portal 7.3.7 through 7.4.3.92 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Liferay DXP...

Liferay DXP 2024.Q1.1 Liferay Portal 7.4.3.112 Liferay DXP 2023.Q3.6 Liferay DXP 2023.Q4.3 Liferay DXP 7.3 U36 The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size...

Liferay DXP 7.3 U35 Liferay DXP 2023.Q3.6 Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal and Liferay DXP allows remote attackers to inject...

Liferay DXP 7.3 U36 Liferay Portal and Liferay DXP does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted...

Liferay Portal 7.0.0 through 7.4.3.132 Liferay DXP 2023.Q4.0 through 2023.Q4.1 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 GA through update 92 Liferay DXP 7.3 GA through update 35, and...

Liferay Portal 7.4.3.120 Liferay Portal 7.4.3.120 Liferay DXP 2024.Q2.0 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.6 Liferay DXP 2023.Q3.9 Liferay DXP 2024.Q1.1 Liferay DXP 2024.Q2.0 Liferay DXP...

Liferay DXP 2024.Q4.6 Liferay DXP 2024.Q1.13 Liferay DXP 2025.Q2.0 Liferay DXP 2025.Q1.5 A vulnerability in Liferay Portal and Liferay DXP allows sensitive user data to be included in the...

A memory leak in the headless API for StructuredContents in Liferay Portal and Liferay DXP allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API...

Liferay Portal 7.4.3.113 Liferay DXP 2024.Q2.0 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.9 Liferay Portal 7.2.0 through 7.4.3.112 Liferay DXP 2023.Q4.0 through 2023.Q4.8 Liferay DXP 2023.Q3.1...

Liferay DXP 2024.Q2.0 Liferay Portal 7.4.3.113 Liferay DXP 2023.Q4.8 Liferay DXP 2024.Q1.1 Batch Engine in Liferay Portal and Liferay DXP does not properly check permission with import and export...