Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
99 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
Recommended action: Upgrade to 7.2.10.fp17 or 7.1.10.fp27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SQL injection vulnerability in the Layout module before 4.0.17 from Liferay Portal (7.1.3 through 7.4.3.4), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
Recommended action: Upgrade to 7.2.10.fp17 or 7.1.10.fp27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification before 3.0.9 from Liferay Portal (7.2.1 through 7.4.2), and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.
Recommended action: Upgrade to 7.3.10.u4 or 7.2.10.fp19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' namespace attribute.
Recommended action: Upgrade to 7.4.13.u17 or 7.3.10.u4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal (7.3.2 through 7.4.3.14), and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
Recommended action: Upgrade to 7.4.13.u15 or 7.3.10.u6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Roles Admin Web before 5.0.48 from Liferay Portal (7.4.0 through 7.4.3.36), and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
Recommended action: Upgrade to 7.4.13.u37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.4.13.u257.2.10.fp197.3.10.u5· Vendor fix available
Issue
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
Recommended action: Upgrade to 7.4.13.u25, 7.3.10.u5 or 7.2.10.fp19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal (7.3.2 through 7.4.3.16), and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
Recommended action: Upgrade to 7.4.13.u17 or 7.3.10.u6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site scripting (XSS) vulnerability in Document Library module before 6.0.98 from Liferay Portal (7.4.3.30 through 7.4.3.36), and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Recommended action: Upgrade to 7.4.13.u37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
Recommended action: Upgrade to 7.4.13.u37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.1.10.fp267.2.10.fp157.0.10.fp102· Vendor fix available
Issue
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Recommended action: Upgrade to 7.2.10.fp15, 7.1.10.fp26 or 7.0.10.fp102 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal (v7.4.3.4) and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter prefix.
Recommended action: Upgrade to 7.4.3.5-ga5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.1.10.fp257.2.10.fp147.0.10.fp101· Vendor fix available
Issue
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect parameter (2) FORWARDURL parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Recommended action: Upgrade to 7.2.10.fp14, 7.1.10.fp25 or 7.0.10.fp101 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.1.10.fp187.2.10.fp57.0.10.fp96· Vendor fix available
Issue
In implementation for the portal services before 5.7.3 in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
Recommended action: Upgrade to 7.2.10.fp5, 7.1.10.fp18 or 7.0.10.fp96 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.0.10.fp997.3.10.fp17.1.10.fp237.2.10.fp12· Vendor fix available
Issue
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
Recommended action: Upgrade to 7.3.10.fp1, 7.2.10.fp12, 7.1.10.fp23 or 7.0.10.fp99 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
Recommended action: Upgrade to 7.2.10.fp9 or 7.1.10.fp20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the comliferaysiteadminwebportletSiteAdminPortletname parameter.
Recommended action: Upgrade to 7.2.10.fp9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the comliferayjournalwebportletJournalPortletname parameter.
Recommended action: Upgrade to 7.2.10.fp7 or 7.1.10.fp18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the pauth parameter.
Recommended action: Upgrade to 7.2.10.fp6 or 7.1.10.fp19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu versions 5.0.6 to before 5.0.54, in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the comliferaydocumentlibrarywebportletDLAdminPortletname parameter.
Recommended action: Upgrade to 7.2.10.fp9 or 7.1.10.fp20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.2.10.fp57.0.10.fp967.1.10.fp20· Vendor fix available
Issue
The Flags module before version 5.0.11 in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
Recommended action: Upgrade to 7.2.10.fp5, 7.1.10.fp20 or 7.0.10.fp96 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.1.10.fp197.0.10.fp957.2.10.fp8· Vendor fix available
Issue
The Portlet Configuration module before 4.0.13 in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
Recommended action: Upgrade to 7.2.10.fp8, 7.1.10.fp19 or 7.0.10.fp95 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
Recommended action: Upgrade to 7.2.10.fp5 or 7.1.10.fp20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
Recommended action: Upgrade to 7.2.10.fp7 or 7.1.10.fp19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.2.10.fp97.0.10.fp967.1.10.fp20· Vendor fix available
Issue
Cross-site scripting (XSS) vulnerability in the Frontend JS module before version 4.0.18, in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
Recommended action: Upgrade to 7.2.10.fp9, 7.1.10.fp20 or 7.0.10.fp96 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.