Liferay Portal / Liferay DXP vulnerabilities

The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size of files it combines. A remote attacker can craft URL query strings to generate very large responses, leading to a denial of service attack.

Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions, are vulnerable to self-XSS on the edit Knowledge Base article page. A remote attacker can inject arbitrary script or HTML via a crafted payload in an attachment's filename.

Missing authorization in the Collection Provider component of Liferay Portal and Liferay DXP. Instance users can read and select unauthorized Blueprints across instances.

A reflected cross-site scripting (XSS) vulnerability, caused by a regression, was identified in Liferay Portal and Liferay DXP. A remote authenticated attacker can inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter, and the malicious payload executes in the victim's browser when they access a crafted URL.

The Menu Display Widget in Liferay Portal and Liferay DXP shows content to users who lack permission to view it. This could expose sensitive information to unauthorized users.

An IDOR vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

An insecure direct object reference (IDOR) and improper permission check vulnerability exists in Publications in Liferay Portal and Liferay DXP. A remote authenticated attacker can view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter and edit comments via crafted URLs.

An insecure direct object reference (IDOR) vulnerability exists in the Publications module of Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. A remote authenticated attacker can view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

A cross-site scripting (XSS) vulnerability in the workflow process builder in Liferay Portal and Liferay DXP allows remote authenticated attackers to inject arbitrary web script or HTML via crafted input in a workflow definition.

Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via crafted payloads in user's First Name, Middle Name, Last Name, 'Other Reason' text field, or the name of flagged content.

A stored cross-site scripting (XSS) vulnerability exists in Forms in Liferay Portal and Liferay DXP. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.

The Profile widget in Liferay Portal and Liferay DXP uses a user's name in the Content-Disposition header, allowing remote authenticated users to change the file extension when a vCard file is downloaded.

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter in Announcements and Alerts.

A cross-site scripting (XSS) vulnerability in the web content template in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload in a web content structure's Name text field.

Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to an event in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via crafted payloads in user's First Name, Middle text, or Last Name fields.

A reflected cross-site scripting (XSS) vulnerability exists on the page configuration page in Liferay Portal and Liferay DXP. A remote attacker can inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

In Liferay Portal 7.4.0 through 7.4.3.112 and Liferay DXP (listed versions), audit events record a user's password reminder answer. A remote authenticated user can obtain a user's password reminder answer via the audit events.

A cross-site scripting (XSS) vulnerability in the Search widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.

Liferay Portal 7.3.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template. Remote attackers can view display page templates via crafted URLs.

A stored XSS vulnerability exists in the /o/c/<object-name> API endpoint of a custom object in Liferay Portal and Liferay DXP. Remote attackers can inject arbitrary web script or HTML via the externalReferenceCode parameter.

Multiple cross-site scripting (XSS) vulnerabilities exist in Liferay Portal and Liferay DXP within "Rich Text" type fields in web content structures, Documents and Media Document Types, and custom assets. A remote attacker can inject arbitrary web script or HTML via a crafted payload.

Liferay Portal and Liferay DXP do not properly obtain the remote address of the live site from the database, allowing remote authenticated users to exfiltrate data to an attacker-controlled server (a fake "live site") via the _com_liferay_exportimport_web_portlet_ExportImportPortlet_remoteAddress and _com_liferay_exportimport_web_portlet_ExportImportPortlet_remotePort parameters. To exploit, an attacker must also obtain the staging server's shared secret and add the attacker-controlled server to the staging server's whitelist.

Liferay Portal and Liferay DXP do not limit the number of objects returned from GraphQL queries. A remote attacker can execute queries returning a large number of objects, causing a denial-of-service (DoS) attack.

Liferay Portal and Liferay DXP contain an open redirect vulnerability in System, Instance, and Site Settings. Remote attackers can redirect users to arbitrary external URLs via specific redirect parameters.

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal and Liferay DXP within organization site names. A remote authenticated attacker can inject JavaScript that is stored and executed without proper sanitization or escaping.

JSON Web Services in Liferay Portal and Liferay DXP published to OSGi are registered and invoked directly as classes, allowing Service Access Policies to be executed.

The organization selector in Liferay Portal and Liferay DXP does not check user permission. Remote authenticated users can obtain a list of all organizations.

An Insecure Direct Object Reference (IDOR) vulnerability exists in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0–2024.Q2.7, 2024.Q1.1–2024.Q1.12, 7.4 GA through update 92). A remote authenticated user can access a workflow definition by name via the API.

An improper access control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0-2024.Q2.8, 2024.Q1.1-2024.Q1.12, 7.4 GA through update 92) allows guest users to obtain object entries information via the API Builder.

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal and Liferay DXP within the remote app title field. A remote attacker can inject arbitrary web script or HTML.

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal and Liferay DXP within the Custom Object field label. A remote authenticated attacker can inject JavaScript that is stored and executed through Process Builder's Configuration tab without proper escaping.

Liferay Portal and Liferay DXP expose an "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret. This may reveal information about the application's internal behavior.

The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.

XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.