Known Vulnerabilities

By default, Liferay Portal gives every registered user the Power User role. When a signed in user has the Power User role, the user will have their own site and permissions to manage the site...

Liferay Portal 7.0.1 Liferay Portal 7.0.1 Severity 2 Cross-Site Request Forgery (CSRF) tokens are persisted in the database and may make it easier for an attacker to launch a CSRF attack.

An open redirect vulnerability exists with Facebook authentication. An attacker can potentially exploit this security vulnerability to redirect users to a different site. Severity 2 Liferay Portal...

Severity 2 By constructing the correct URL, some restricted Web Application Bundle (WAB) resources may be accessible. Liferay Portal 7.0.1 Liferay Portal 7.0.1

Liferay Portal 7.0.1 Liferay Portal 7.0.1 Severity 1 This ticket covers various permission issues in Liferay Portal 7.0 CE GA1 that may result in a user having permission the user should not have.

This ticket covers various cross-site scripting (XSS) issues in Liferay Portal 7.0 CE GA1 Severity 2 Liferay Portal 7.0.1 Liferay Portal 7.0.1

Velocity and FreeMarker templates are vulnerable to remote code execution (RCE) and privilege escalation. Severity 1 Note that there are two binary patches which fix this issue, as well as all...

Password policies can be configured to lock out a user after a specified number of failed login attempts. However, if a user is using digest authentication, this lock out can be circumvented....

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

An open redirect vulnerability exists may be possible with some specially constructed domain names. An attacker can potentially exploit this security vulnerability to redirect users to a different...

A vulnerability known as "Java Deserialization Vulnerability" was discovered and Liferay Portal is potential vulnerable in the following locations: TunnelServlet: Spring-Remoting services By...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

This ticket covers various permission issues in Liferay Portal 6.2 CE GA6 that may result in a user having permission the user should not have. Severity 2 Note that there are two binary patches...

XSL Content portlet can be configured with any XML/XSL. The XSL Content portlet allows anyone who has permission to configure the portlet to specify any XML/XSL file. By creating the appropriate...

Flash does not strictly honor the same-origin policy. As a result, if an attacker is able to upload a malicious flash file to portal, the flash file can be used to circumvent the portal's CSRF...

The version of openid4java.jar that is currently used by the portal vulnerable to XXE attack. Severity 2 Note that there are two binary patches which fix this issue, as well as all previous CST...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...

The MailEngine API is vulnerable to email header injection. This issue only affects users who are calling the MailEngine directly. Severity 3 Note that there are two binary patches which fix this...

This ticket covers various permission issues in Liferay Portal 6.2 CE GA3 that may result in a user having permission the user should not have. Severity 2 Note that there are two binary patches...

Note that there are two binary patches which fix this issue, as well as all previous CST fixes for this release. You only need to apply one of these, not both. Binary Patch 1: The "complete" patch...