Skip to Main Content

Ask
Blogs
Chat
Download
Feedback
Help
Learn
Projects
/dev/24
Log In

Known Vulnerabilities

Overview
Reporting Security Issues
Known Vulnerabilities
Hall of Fame

Releases

Liferay Portal 7.4

Liferay Portal 7.3

Liferay Portal 7.2

Liferay Portal 7.1

Liferay Portal 7.0

Liferay Portal 6.2 CE

Liferay DXP 7.4

Liferay DXP 7.3

Liferay DXP 7.2

LIferay DXP 7.1

LIferay DXP 7.0

Liferay DXP 2024 Q2

Liferay DXP 2024 Q1

Liferay DXP 2023.Q4

Liferay DXP 2023.Q3

RSS

CVE-2024-8980 Mitigate against simple XSS attacks against script console
CVE-2024-26271 CSRF bypass related to `backURL` in My Account
CVE-2024-26273 CSRF bypass related to `redirect` in Commerce Catalogs
CVE-2024-26272 CSRF bypass related to `p_l_back_url` in content page editor
CVE-2024-38002 Regular users can edit workflow definition
CVE-2023-47795 XSS with Document and Media document title
CVE-2024-25151 Possible XSS & content spoofing in notifications emails
CVE-2023-40191 XSS with with Account "Blocked Email Domains"
CVE-2023-42498 XSS with `key` in language override
CVE-2024-26266 Stored XSS with user name in Announcements & Alerts
CVE-2024-26269 XSS with anchor/hash part of a URL in portlet.js
CVE-2023-42496 XSS with `tabs2` in role assignment
CVE-2024-25603 Stored XSS with instanceId in DDMForm
CVE-2024-25152 Stored XSS with message board file attachment
CVE-2024-25601 Stored XSS with geolocation custom fields
CVE-2024-25602 Stored XSS with organization name in edit user
CVE-2024-25147 HtmlUtil.escapeJSLink circumvention
CVE-2024-26270 User's hashed password appears in page's HTML source
CVE-2024-26268 User enumeration vulnerability by comparing login response time
CVE-2024-26267 Insecure default for the property `http.header.version.verbosity`
CVE-2024-26265 File system flooding through the Image Uploader
CVE-2024-25610 Stored XSS with Blog entries (Insecure defaults)
CVE-2024-25609 HtmlUtil.escapeRedirect circumvention with two forward slash
CVE-2024-25608 Open redirect vulnerability using Replacement Character
CVE-2024-25607 Default password hashing algorithm do not provide sufficient protection
CVE-2024-25606 XXE vulnerability in Java2WsddTask._format
CVE-2024-25605 Unauthorized access to Web Content templates
CVE-2024-25604 User can access and edit their own permissions
CVE-2024-25150 User full name disclosure in page title
CVE-2023-44308 Open redirect in adaptive media
CVE-2023-5190 Open redirect in Countries Management
CVE-2024-25149 Users without parent site membership can be registered on child sites
CVE-2022-45320 Wiki page privilege escalation
CVE-2024-25148 'doAsUserId' value may get leaked when using WYSIWYG editor to create content
CVE-2024-25146 Unauthorized users can discover if a site exist
CVE-2024-25145 Stored XSS with search results if highlighting is disabled
CVE-2024-25144 DoS via a self-referencing IFrame
CVE-2024-25143 DoS vulnerabilities via crafted PNG image
CVE-2021-29050 CSRF vulnerability in Terms of Use page
CVE-2021-29038 Password reminder answers are not obfuscated
CVE-2023-47798 Account lockout does not invalidate user sessions
CVE-2023-47797 XSS with `p_l_back_url_title` on edit content page
CVE-2023-42497 XSS with `redirect` in export translation
CVE-2023-42629 Stored XSS vulnerability with vocabulary description
CVE-2023-44309 XSS with fragment components
CVE-2023-44310 XSS with page name in Page Tree
CVE-2023-44311 Reflected XSS with 'code' and 'error' in OAuth2ProviderApplicationRedirect
CVE-2023-42628 XSS with child wiki pages
CVE-2023-42627 Multiple stored XSS with shipping & billing address
CVE-2023-3426 Unauthorized view access to Organization names
CVE-2023-3193 Reflected XSS with backURL in SEO configuration
CVE-2023-35029 Open redirect with backURL in SEO configuration
CVE-2023-35030 CSRF/RCE with backURL in SEO configuration
CVE-2023-33937 Stored XSS with form name in form configuration
CVE-2023-33938 Stored XSS with object name in App Builder
CVE-2023-33939 Stored XSS in Modified Facet
CVE-2023-33940 Stored XSS with IFrame type Remote App URL
CVE-2023-33941 Reflected XSS with 'code' and 'error' in OAuth2ProviderApplicationRedirect
CVE-2023-33942 Stored XSS with article title in Web Content Display widget
CVE-2023-33943 XSS with user name in account
CVE-2023-33944 XSS with container layout fragment URL
CVE-2023-33945 SQL injection in SQL Server upgrades
CVE-2023-33946 Unauthorized access to objects via OAuth 2 scope
CVE-2023-33947 Unauthorized access to object definition via search
CVE-2023-33948 Unauthorized access to Document and Media files via Forms
CVE-2023-33949 Users do not have to verify their email address by default
CVE-2023-33950 ReDoS vulnerability with Pattern Redirects
CVE-2022-42132 LDAP credentials exposed in URL
CVE-2022-42131 DDMRESTDataProvider vulnerable to man-in-the-middle attack
CVE-2022-42130 Unauthorized access to form entries via API
CVE-2022-42129 Insecure direct object reference vulnerability with Form entries
CVE-2022-42128 Unauthorized access to WikiNodeResource.getSiteWikiNodeByExternalReferenceCode
CVE-2022-42127 Friendly URL history accessible to unauthorized users
CVE-2022-42126 User permissions are not checked for DepotGroupItemSelectorProvider
CVE-2022-42125 Zip slip vulnerability in FileUtil.unzip
CVE-2022-42124 ReDoS vulnerability in upgrade of layout prototype name
CVE-2022-42123 Zip Slip vulnerability in Elasticsearch Connector
CVE-2022-42122 SQL injection in friendly URL upgrade
CVE-2022-42121 SQL injection vulnerability during page template upgrade
CVE-2022-42120 SQL injection vulnerability during fragment upgrade
CVE-2022-42119 Stored XSS with ERC in Commerce catalog
CVE-2022-42118 Reflected XSS with `tag` in Search
CVE-2022-42117 Reflected XSS with `label` attribute in <clay:label>
CVE-2022-42116 Reflected XSS with name & namespace parameter in integration with CKEditor
CVE-2022-42115 Stored XXS with object field label
CVE-2022-42114 Stored XSS with role key in edit assignees page
CVE-2022-42113 Reflected XSS with `redirect` in Document & Media
CVE-2022-42112 Stored XSS with sort by label in Search Sort widget
CVE-2022-42111 Stored XSS with a shared asset name in notification
CVE-2022-42110 Stored XSS with announcement/alert type
CVE-2022-38901 Stored XSS with categories selector fields
CVE-2022-38902 Stored XSS with SVG file description
CVE-2022-39975 Unauthorized access to "Content Page" previews
CVE-2022-38512 Unauthorized access to web content translation export
CVE-2022-25146 CSRF token exfiltration via Remote Apps
CST-7230 Invalid portlet mode cause product menu to be inaccessible
CST-2022-01 Insecure defaults: auth.login.prompt.enabled
CVE-2021-38264 Reflected XSS with `keywords` in Search
CVE-2022-26593 Stored XSS with category name in asset categories selector
CVE-2022-26594 XSS vulnerability with form field help text
CVE-2022-26595 Unauthorized access to site/group list
CVE-2022-26597 Stored XSS with site name in Open Graph integration
CVE-2022-28977 HtmlUtil.escapeRedirect circumvention with multiple forward slash
CVE-2022-28978 Stored XSS with user name in site membership
CVE-2022-28979 XSS in Custom Facet widget
CVE-2022-28980 Reflected XSS with filter_* parameters in applied fragment filters
CVE-2022-28981 Path traversal vulnerability in Hypermedia REST APIs
CVE-2022-28982 Reflected XSS with tag name in <liferay-asset:asset-tags-selector>
CVE-2021-38263 Reflected XSS with Script page
CVE-2021-38265 Stored XSS with Collection name
CVE-2021-38266 DoS vulnerability prevents LDAP users from authenticating
CVE-2021-38267 Stored XSS with title and subtitle of blog entry
CVE-2021-38268 Site member can add new forms by default
CVE-2021-38269 Stored XSS with Gogo Shell output
CST-7229 Mail server DoS via MembershipRequestService
CST-7067 Reflected XSS in edit workflow configuration
CVE-2021-35463 Reflected XSS with `keywords` in Search
CVE-2021-29053 SQL/HQL Injection in Commerce Address Web & Commerce Product Service
CVE-2021-29039 Stored XSS with Site name in Categories
CST-7227 Reflected XSS with 'backURL' in Users and Organizations
CST-7228 Stored XSS with Tags name
CVE-2021-29040 Overly verbose JSON web services errors
CVE-2021-29043 S3 store's proxy password visible in System Settings
CVE-2021-29044 Stored XSS with membership request comment
CVE-2021-29045 Stored XSS with Destination URL of Redirection
CVE-2021-29046 Stored XSS with category name
CVE-2021-29047 SimpleCaptcha answer reuse
CVE-2021-29048 Stored XSS with Site Page name
CVE-2021-29051 Reflected XSS with 'assetEntryId' in Asset Publisher
CVE-2021-29052 Unauthorized users can view DDMStructures
CVE-2021-33320 Flagging content as inappropriate is not rate limited
CVE-2021-33321 Insecure default configuration allows for user enumeration using forgot password
CVE-2021-33322 Password change does not invalidate password reset tokens
CVE-2021-33323 Unauthenticated form drafts are visible to everybody
CVE-2021-33324 Unauthorized users can view a site's pages via page administration
CVE-2021-33325 User's unencrypted passwords stored in database
CVE-2021-33326 XSS with the title of a modal window
CVE-2021-33327 Unauthorized users can view the Guest and User roles
CVE-2021-33328 Stored XSS with Web Content Structure names and Document Types names in Categories Admin
CVE-2021-33330 CORS should not work with Portal Session authentication
CVE-2021-33331 Open redirect vulnerability in notifications
CVE-2021-33332 Reflected XSS with portletId in Look and Feel Configuration
CVE-2021-33333 Unauthorized users can view and delete workflow submissions
CVE-2021-33334 Unauthorized users can view forms and form entries
CVE-2021-33335 Non-company admins can edit company admins
CVE-2021-33336 Stored XSS with Structure name
CVE-2021-33337 Stored XSS with Document Types in Documents and Media
CVE-2021-33338 Adding pages exposes CSRF token
CVE-2021-33339 Stored XSS with Site name in Fragment portlet
CVE-2022-26596 Stored XSS with Template name
CST-7224 Stored XSS with user name in Document & Media file info panel
CST-7225 OAuth2 authentication bypass of REST application API
CST-7226 Open redirect in System Settings' search
CST-7307 Unauthorized users can delete a staging publishing process
CST-7308 'portlet.resource.id.banned.paths.regexp' bypass with doubled encoded URLs
CST-7309 User enumeration via forget password
CST-7310 Reflected XSS in Page Fragments' edit page
CST-7311 Blog cover image extension circumvention
CST-7312 Libraries with known vulnerabilities in 7.2.1 and 7.3.2
CST-7313 Stored XSS with user name in workflow definition editor
CST-7314 Viewing Calendar widget prevents Instance Settings from saving
CST-7315 Unauthorized access to staged public pages's sitemap.xml
CST-7316 Reflected XSS with 'openId' in Login module
CST-7317 DoS vulnerability with multipart/form-data requests
CST-7318 Database DoS in URL Redirections Management
CST-7150 JAX-RS APIs are vulnerable to CSRF
CST-7213 Java deserialization vulnerability in clustered setup
CST-7214 LDAP credentials exposed by 'Test LDAP Connection'
CST-7215 SSRF vulnerability via DDM REST Data Provider
CST-7216 Multiple XSS vulnerabilities in 7.1.3 and 7.2.1
CST-7217 Downloading MySQL Connector/J is vulnerable to MITM attacks
CST-7218 Libraries with known vulnerabilities in 7.1.3 and 7.2.1
CST-7219 Documents and Media file extension restriction circumvention
CST-7220 Directory traversal with Page Fragment exports
CST-7221 Flag email injection vulnerability
CST-7222 Any user can display unconfigured instance of an instantiable widget
CST-7223 Private site disclosure via Blogs RSS
CST-7301 DDMDataProvider API leaks REST data provider password
CST-7302 Remote code execution with FreeMarker/Velocity templates
CST-7303 Circumvention of open redirect prevention using tabs
CST-7304 Stored XSS with user name in workflow assignments
CST-7305 Libraries with known vulnerabilities in 7.3.0 and 7.3.1
CST-7306 Unauthorized users can view a site's user groups
CST-7114 Security vulnerabilities in Apache Tika
CST-7144 Vulnerabilities in Lodash 4.17.4
CST-7145 User enumeration via forget password
CST-7146 Security vulnerability in Jackson Databind 2.9.8
CST-7147 Security vulnerability in Jasig CAS Client 3.1.12
CST-7148 Security vulnerability in Apache Commons BeanUtils 1.9.2
CST-7149 Security vulnerability in Apache Tika 1.20
CST-6237 Password disclosure through IFrame portlet
CST-6238 Remote file disclosure with DDM templates
CST-6239 Denial-of-service vulnerability with file uploads
CST-6240 User with impersonate permission can elevate privileges to portal administrator
CST-7062 Denial-of-service vulnerability with embedded portlets
CST-7063 Pingback vulnerability in blogs
CST-7064 Remote code execution vulnerability in templates
CST-7065 DoS and MiM vulnerabilities in Apache Commons HttpClient
CST-7066 Users without proper permissions can add pages
CST-7211 User can change password without current password

Security advisories for Liferay's enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.

Community
Ask
Events
Learn
Meet

Company
Blogs
Careers
Download
Open Source

Feedback
Contact Us

Copyright © 2024 Liferay, Inc

Powered by Liferay Portal CE™

We use cookies to deliver personalized content, analyze trends, administer the site, track user movements on the site, and collect demographic information about our user base as a whole. Accept all cookies for the best possible experience on our website or manage your preferences. Visit our Privacy Policy