Known Vulnerabilities

All files within the application's WAR folder is accessible via crafted URL. Severity 1 Liferay Portal 7.0.5 Liferay Portal 7.0.5

Severity 2 Open redirect vulnerability in the Asset Publisher application allows remote attackers to redirect users to arbitrary web sites. Liferay Portal 7.0.5 Liferay Portal 7.0.5 This issue was...

Severity 1 Liferay Portal 7.0.5 Liferay Portal 7.0.5 Unauthenticated users can modify system settings to gain administration privileges.

Severity 1 In Liferay Portal 7.0.4 and earlier, when Xuggler is enabled for video conversion, a large number of temporary files may be created during video playback, which allows remote users to...

Passwords are visible to administrators in the System Settings section of the Control Panel. Severity 2 Liferay Portal 7.0.5 Liferay Portal 7.0.5

Severity 2 Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Liferay Portal 7.0.5 Liferay Portal 7.0.5

Liferay Portal 7.0.5 Some vulnerabilities reported by Marko Winkler Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page....

Severity 2 In a shared environment (e.g., a computer at a library or internet cafe), a user's reminder query answer may be accessible by another user. Liferay Portal 7.0.4 Liferay Portal 7.0.4

Severity 2 User's email address, screen name or user id (depending on the authentication method) is exposed in URL. Liferay Portal 7.0.4 Liferay Portal 7.0.4

Liferay Portal 7.0.4 Liferay Portal 7.0.4 Multiple permission issue allows users to perform actions on resources which they are not authorized to perform. Severity 2

Severity 2 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Liferay Portal 7.0.4 Liferay Portal 7.0.4

7.0.3-ce-ga4-security-1.0 patch (source) In Liferay Portal 7.0 CE GA4, the path to all OSGi bundles is exposed via crafted URL. Severity 1

In Liferay Portal 7.0 CE GA3, Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary...

In Liferay Portal 7.0 CE GA4, multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML into a page. Severity 2 7.0.3-ce-ga4-security-1.0...

7.0.3-ce-ga4-security-1.0 patch (source) March 2020 source patch for Liferay Portal 6.2.5. Details for working with source patches can be found on the Patching Liferay Portal page. In Liferay...

In Liferay Portal 7.0 CE GA4, AggregateFilter, MinifierFilter and DynamicCSSFilter allows unauthenticated users to cause a denial of service (disk consumption) via crafted URL. Severity 1...

Liferay Portal 7.0.0 Liferay Portal 7.0.0 This issue was reported by Marko Winkler Severity 2 Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web...

User credentials may appear in the logs if the user authenticates using basic authentication. Severity 2 Liferay Portal 7.0.0 Liferay Portal 7.0.0

Severity 2 Insufficient permission checking in Message Board and Comments allows unauthorized users to edit and/or delete other user's messages or comments. Liferay Portal 7.0.0 Liferay Portal...

Severity 2 Liferay Portal 7.0.0 Liferay Portal 7.0.0 This issue was reported by Spyridon Chatzimichail Users without the necessary permssion can view page configuration information the via crafted...