Known Vulnerabilities

March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay 7.1.0 through 7.1.3, unauthorized users can...

Severity 2 In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the Sign In widget may expose the user's email address and/or password in the page's HTML source. This may allow...

Severity 2 In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the search results from the Search Bar widget uses links that redirect users to HTTP instead of HTTPS. Liferay...

In Liferay Portal 7.1.3, 7.2.0 and possibly earlier unsupported versions, the 'com.liferay.map.openstreetmap' bundle loads the npm package, leaflet, using HTTP instead of HTTPS. Severity 2 Liferay...

Liferay Portal 7.2.1 Liferay Portal 7.2.1 Severity 2 In Liferay Portal 7.2 CE GA1 and possibly earlier unsupported versions, an open redirect vulnerability exists in Account Settings.

In Liferay Portal 7.1 CE GA4, 7.2 CE GA1 and possibly earlier unsupported versions, the Hello World widget reveals the DXP version information. The verbosity of the version information can now be...

Severity 1 In Liferay Portal 7.2.0 and earlier contains a remote code execution (RCE) vulnerability via JSON web services (JSONWS).   Workaround: Disable JSONWS by setting the portal.property...

Liferay Portal 7.2.1 March 2020 source patch for Liferay Portal 7.1.3. Details for working with source patches can be found on the Patching Liferay Portal page. Liferay Portal 7.2.1 In Liferay...

Severity 2 Liferay Portal 7.2 CE GA1 includes the following libraries which have known vulnerabilities: Apache Commons BeanUtils 1.9.2 Apache Tika 1.20 Jackson Databind 2.9.9 Jasig CAS Client...

Multiple permission issue exists in Liferay Portal 7.2 CE GA1 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.2.1 Liferay...

Liferay Portal 7.2.1 Liferay Portal 7.2.1 Severity 2 In Liferay Portal 7.2 CE GA1, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

Liferay Faces Alloy 2.0.2 (source) Liferay Faces Alloy 2.0.2 (source) Liferay Faces Alloy 3.0.2 (source) To install, remove any old versions of Liferay Faces Alloy and place the fixed version of...

To install, remove any old versions of Liferay Faces Alloy from your WAR and place the new version of Liferay Faces Alloy in each of your Liferay Faces WARs in the WEB-INF/lib directory. Make sure...

Binary patch (source) To install, place patch in each of your Liferay Faces WARs in the WEB-INF/lib directory. The dependency can be included via Maven, Gradle, or Ivy. In a Maven project pom.xml...

Severity 1 Liferay Portal 7.1.0 and earlier is vulnerable to remote code execution using Web Content/DDM templates. Workaround: Review permissions and do not grant untrusted users permissions to...

When defining permissions for a role in Liferay Portal 7.1 CE GA3 and older unsupported versions, some permissions may be selected by default. This may unintentionally lead to some users receiving...

Severity 2 In Liferay Portal 7.1 CE GA3 and older unsupported versions, an open redirect vulnerability exist in the Language Selector widget. Liferay Portal 7.1.3 Liferay Portal 7.1.3

Liferay Portal 7.1.3 In Liferay Portal 7.1 CE GA3 and older unsupported versions, a path traversal vulnerability exists in poller. Severity 2 Liferay Portal 7.1.3

Severity 2 Liferay Portal 7.1 CE GA3 includes the following libraries which have known vulnerabilities: Apache Batik 1.7 Apache HttpClient 4.1 Apache PDFBox 2.0.9 Apache Tika 1.18 c3p0 0.9.5.2...

In Liferay Portal 7.1 CE GA3, multiple cross-site scripting (XSS) vulnerabilities exists which allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 Liferay Portal...