Known Vulnerabilities

Liferay Portal 7.1.3 Liferay Portal 7.1.3 Severity 1 Liferay Portal 7.1 CE GA3 and older unsupported versions and older unsupported versions is vulnerable to Server-Side Request Forgery (SSRF) via...

In Liferay Portal 7.1 CE GA3 and older unsupported versions, Message Boards post that are marked as "Anonymous" can be associated with the user who posted it. This issue exists because of an...

Severity 2 In Liferay Portal 7.1 CE GA3 and older unsupported versions, a company's secret key is accessible via templates. Liferay Portal 7.1.3 Liferay Portal 7.1.3

Liferay Portal 7.1.3 Liferay Portal 7.1.3 Severity 2 In Liferay Portal 7.1 CE GA3 and older unsupported versions, user password hashes and password reminder answers may be appear in the logs if a...

Multiple permission issue exists in Liferay Portal 7.1 CE GA3 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay Portal 7.1.3 Liferay...

Severity 2 Message boards post that are marked as "Anonymous" can be associated with the user who posted it. Liferay Portal 7.1.2 Liferay Portal 7.1.2

Severity 2 Liferay Portal 7.1.2 Liferay Portal 7.1.2 An open redirect vulnerability exist in Liferay Portal 7.1 CE with the <liferay-ui:header> tag.

Severity 2 In Liferay Portal 7.1 CE, an unexpected error may produce an overly verbose error message that is visible to end users. Liferay Portal 7.1.2 Liferay Portal 7.1.2

User login in Liferay Portal 7.1 CE is vulnerable to Cross-Site Request Forgery (CSRF) attacks. Severity 2 Liferay Portal 7.1.2 Liferay Portal 7.1.2

Severity 1 A bug in Liferay Portal CE 7.1 CE allows any authenticated user to change the password of another user, including an administrator. Once a user has access to an administrator account, a...

Liferay Portal 7.1.2 Multiple permission issue exists in Liferay Portal 7.1 CE GA2 which allows users to perform actions on resources which they are not authorized to perform. Severity 2 Liferay...

Severity 2 A stored cross-site scripting (XSS) vulnerability exits with the image resolution information in Adaptive Media in Liferay CE 7.1 GA2. Liferay Portal 7.1.2 Liferay Portal 7.1.2

Severity 1 Liferay Portal 7.1.0 and earlier is vulnerable to remote code execution (RCE) via deserialization of JSON data. Liferay Portal 7.1.1 Liferay Portal 7.1.1 March 2020 source patch for...

Liferay Portal 7.1.1 March 2020 source patch for Liferay Portal 7.0.6. Details for working with source patches can be found on the Patching Liferay Portal page. March 2020 source patch for Liferay...

Severity 2 The password reset token may be leaked to 3rd party website in Liferay Portal 7.1 CE. Out of the box, the password reset token is not leaked to any 3rd party website. However, if the...

The default configuration for Liferay Portal 7.0.0 through 7.1.0 allow attackers to conduct XML External Entity (XXE) attacks via XSL templates in XSL Content and Web Content. Workaround: 1....

Liferay Portal 7.1.1 Liferay Portal 7.1.1 Severity 2 In Liferay Portal 7.1 CE GA1, users are normally required to enter their current password if they want to change their password. However, the...

Notification emails sent to users in Liferay Portal 7.1 CE GA1 is vulnerable to HTML injection. An attacker can exploit this vulnerability for phishing attacks. Severity 2 Liferay Portal 7.1.1...

Severity 2 Liferay Portal 7.1.0 and earlier is vulnerable to a Server-Side Request Forgery (SSRF) via Web Content templates and Application Display Templates (ADT) which may allow an attacker...

Severity 2 Liferay Portal 7.1.1 Liferay Portal 7.1.1 An LDAP injection vulnerability exits in Liferay 7.1 CE GA1 with user group names.