Liferay Portal vulnerabilities

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Multiple cross-site scripting (XSS) vulnerabilities in the web content template's select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, or (3) Last Name text field.

Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.

Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's "Content" text field. The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user's password even if account lockout is enabled via brute force attack.

A CSRF vulnerability in the Headless API of Liferay Portal and Liferay DXP allows remote attackers to execute any Headless API call via the `endpoint` parameter.

Liferay Portal and Liferay DXP do not limit the number of objects returned from Headless API requests. This allows remote attackers to perform denial-of-service (DoS) attacks by executing a request that returns a large number of objects.

Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role's "Title" text field and an Organization's "Name" text field. The vulnerability affects Portal 7.3.7 through 7.4.3.103 and DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 SP3 through update 36.

Liferay Portal (versions 7.4.0 through 7.4.3.97 and older) and Liferay DXP (specific versions) contain an open redirect vulnerability in page administration. A remote attacker can redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

Liferay Portal (versions 7.4.0 through 7.4.3.132) and Liferay DXP (specific versions) are vulnerable to reflected XSS in the google_gadget parameter. A remote, unauthenticated attacker can inject JavaScript.

Improper Authentication in Liferay Portal and Liferay DXP allows remote attackers to send malicious data that is treated as trusted via unauthenticated cluster messages.

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user's first, middle, or last name text field, displayed in page comments, blog entry comments, document and media comments, message board messages, wiki page comments, and other widgets/apps that support mentions. The vulnerability affects Portal 7.4.0 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92.

Liferay Portal and Liferay DXP contain an IDOR vulnerability involving account addresses. A remote authenticated user can view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal and Liferay DXP allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account's "Name" text field. The vulnerability affects Portal 7.4.3.21 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92.

Stored cross-site scripting (XSS) vulnerability in Commerce's view order page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account's "Name" text field. The vulnerability affects Portal 7.4.3.8 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92.

Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's first, middle, or last name text field. The vulnerability affects Portal 7.4.3.35 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36.

Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an SVG file. The vulnerability affects Portal 7.4.3.18 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92.

Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field. The vulnerability affects Portal 7.4.0 through 7.4.3.111 and DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92.

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a Terms and Condition's Name text field on the view order page.

Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.

In Liferay Portal and Liferay DXP, sensitive user data may be included in the Freemarker template. This weakness permits an unauthorized actor to access confidential information that should remain restricted.

ComboServlet in Liferay Portal and Liferay DXP has a possible path traversal vulnerability and denial-of-service. A remote attacker can access arbitrary CSS and JSS files and load files multiple times via the query string in a URL.

Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a Calendar's "Name" text field.

Multiple stored cross-site scripting (XSS) vulnerabilities in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92. A remote authenticated attacker can inject arbitrary web script or HTML via a crafted payload injected into an asset author's First Name, Middle Name, or Last Name text field.

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.112 and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92. A remote authenticated attacker can inject JavaScript via the _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. The malicious payload is reflected and executed in the user's browser.

Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permissions with import and export tasks, allowing remote authenticated users to access exported data via REST APIs.

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a publication's "Name" text field.

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112 and Liferay DXP in specified versions saves virtual products uploaded to Documents and Media with guest view permission. This allows remote attackers to access and download virtual products for free via a crafted URL.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, and 7.4 GA through update 92. A remote attacker can register a server license via the 'orderUuid' parameter.

Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.

A vulnerability in Liferay Portal and Liferay DXP involves unchecked input for a loop condition in XML-RPC. This allows remote attackers to perform denial-of-service (DoS) attacks via a crafted XML-RPC request.

In Liferay Portal (versions 7.1.0 through 7.4.3.111) and Liferay DXP (specific versions), the default membership type of a newly created site is "Open", allowing any registered user to become a member. A remote attacker with site membership can view, add, or edit content on the site.

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, allowing remote users to access and edit content via the API.

A cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111 and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

Liferay Portal 7.4.0 through 7.4.3.105 and older unsupported versions, as well as Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie. This allows remote attackers who control a website sharing the same TLD to read cookies set by the application.

A stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated attackers with the instance administrator role to inject arbitrary web script or HTML into all pages via a crafted payload injected into the Instance Configuration's CDN Host HTTP or CDN Host HTTPS text fields.

Liferay Portal 7.4.3.73 through 7.4.3.128 and Liferay DXP in specific versions are vulnerable to Reflected Cross-Site Scripting. Remote attackers can inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128 and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92. Remote attackers can execute arbitrary web script or HTML in the My Workflow Tasks page.

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allows attackers to determine existent ERC in the application by exploiting the time response.

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the URL in the search bar portlet.

A stored cross-site scripting vulnerability in Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.

Kaleo Forms Admin in Liferay Portal and Liferay DXP does not restrict saving request parameters in the portlet session. A remote attacker can send crafted HTTP requests to consume system memory and cause denial-of-service (DoS) conditions.

In Liferay Portal and Liferay DXP, the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions.

In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.