Known Vulnerabilities

Severity 1 Pattern Redirects in Liferay Portal and Liferay DXP allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an...

Liferay DXP 7.4 update 67 Liferay Portal 7.4.3.67 Liferay DXP 7.4 update 68 Liferay DXP 7.4 update 68 Liferay Portal 7.4.3.68 Liferay Portal 7.4.3.68 Severity 2 The Dynamic Data Mapping module in...

Liferay Portal 7.3.1 Severity 2 In Liferay Portal and Liferay DXP the default configuration does not require users to verify their email address, which allows remote attackers to create accounts...

Liferay Portal 7.4.3.61 Severity 2 The Object module in Liferay Portal and Liferay DXP does not segment object definition by virtual instance in search which allows remote authenticated users in...

Severity 2 The Object module in Liferay Portal and Liferay DXP does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view...

Severity 2 Liferay DXP 7.3 update 6 Liferay DXP 7.4 update 18 Liferay Portal 7.4.3.18 Liferay DXP 7.3 before update 6 Liferay DXP 7.4 before update 18 Liferay Portal 7.3.1 - 7.3.7 Liferay Portal...

Liferay DXP 7.3 update 24 Liferay DXP 7.3 update 24 Liferay DXP 7.4 update 69 Liferay Portal 7.4.3.69 Liferay Portal 7.4.3.69 Liferay DXP 7.4 update 69 Severity 2 Cross-site scripting (XSS)...

Severity 2 Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload...

Liferay DXP 7.4 update 50 Liferay Portal 7.4.3.50 Liferay DXP 7.4 update 51 Liferay DXP 7.4 update 51 Liferay Portal 7.4.3.51 Liferay Portal 7.4.3.51 Severity 2 Cross-site scripting (XSS)...

Liferay Portal 7.4.3.53 Severity 2 Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal and Liferay DXP...

Severity 2 Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the Remote App's...

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

Severity 2 Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script...

Liferay Portal 7.3.1 Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal, and Liferay DXP allows remote attackers to inject arbitrary web script or HTML...

Liferay Portal 7.0.0 - 7.0.6 Liferay Portal 7.1.0 - 7.1.3 Liferay Portal 7.2.0 - 7.2.1 Liferay Portal 7.3.0 - 7.3.7 Liferay Portal 7.4.0 - 7.4.3.4 Liferay Portal 7.4.3.5 Liferay Portal 7.4.3.5...

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.2 does not validate HTTPS certificates used with DDMRESTDataProvider, which allows man-in-the-middle attackers to impersonate,...

Severity 2 The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4 does not properly check permission of form entries, which allows remote authenticated users to view and access all...

Severity 2 Liferay Portal 7.4.3.5 There is no fix available for Liferay Portal 7.3. Please upgrade to Liferay Portal 7.4. Liferay Portal 7.3.2 - 7.3.7 Liferay Portal 7.4.0 - 7.4.3.4 Liferay Portal...

Severity 2 The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the...

Severity 2 The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 does not properly check user permission, which allows remote attackers to obtain the history of all friendly URLs that...