Liferay Portal
Monthly
Remote code execution in Liferay Portal Community Edition (CE) versions prior to 7.2.1 CE GA2 allows unauthenticated remote attackers to run arbitrary Java code by abusing the JSON web services (JSONWS) interface. This flaw is confirmed actively exploited (CISA KEV) - it was leveraged by the 'FreakOut' botnet - with publicly available exploit code and an EPSS score of 99.78% (100th percentile), placing it among the most likely to be exploited vulnerabilities. It carries a CVSS 9.8, reflecting network-reachable, no-authentication, no-interaction exploitation with full confidentiality, integrity, and availability impact.
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Liferay Portal 7.4.3.35-7.4.3.111 and Liferay DXP (2023.Q4.0-2023.Q4.10, 2023.Q3.1-2023.Q3.10, 7.4 update 35-92) lets an authenticated user who can modify First, Middle, or Last Name fields inject script that runs when a victim opens the web content template 'select structure' page. The vendor rates it CVSS 4.0 base 4.6 (medium); the independent assessment uses CVSS 3.1 with PR:L/UI:R/S:C and low confidentiality and integrity impact, with no availability effect. EPSS is 0.23% (13th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.
Reflected cross-site scripting in Liferay Portal and Liferay DXP's Language Override portlet allows unauthenticated remote attackers to inject arbitrary web script or HTML through the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter, but exploitation requires the victim to click a crafted URL (UI:A). Affected deployments are Liferay Portal 7.4.3.8 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92; impact is limited to the victim's browser session with low confidentiality and integrity impact and no availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.24% (14th percentile).
Stored cross-site scripting in the Liferay Portal/DXP Blogs widget allows authenticated users with blog-content authoring rights to inject a crafted <iframe> into a blog entry's Content field, and the widget's failure to sandbox iframes can let the framed page access the parent page when a victim views the entry. It is rated CVSS 4.0 base 4.8 (Medium) and assessed as requiring authenticated blog-authoring access plus victim interaction, with impact limited to low confidentiality and integrity in the victim's browser context. No public exploit was identified at time of analysis, and there is no unauthenticated or default-configuration remote path described in the available data.
Liferay Portal and Liferay DXP expose an open redirect that can send users to attacker-chosen external sites when redirect URL security remains at its default IP-based validation. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.119 and Liferay DXP 7.4 GA through update 92, plus the listed 2023.Q3, 2023.Q4, and 2024.Q1 releases; remote unauthenticated attackers can exploit it through DNS rebinding, but a victim must click and follow the crafted redirect. No public exploit identified at time of analysis, and the issue is a medium-severity, low-priority open redirect rather than a code-execution or server-compromise flaw.
Password enumeration in Liferay Portal 7.4.0 through 7.4.3.119 and the listed Liferay DXP 2023.Q3 through 2024.Q1 quarterly releases lets unauthenticated remote attackers use sustained brute-force guessing to distinguish a correct password from an incorrect one even when account lockout is enabled, so the lockout control does not actually stop repeated authentication attempts. The exposure is an information leak rather than account takeover: an attacker who already knows or can enumerate a valid username can, given enough attempts, confirm or recover a weak password for that account. Attackers must be able to reach the authentication endpoint over the network, and success is probabilistic and highly dependent on password strength, so this is a medium-severity defense-in-depth issue (CVSS 4.0 base 6.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no CISA KEV listing.
Liferay Portal and Liferay DXP deployments can let a remote user who holds a registered but not-yet-verified account access and edit content through exposed APIs, because the platform does not enforce email-verification gating on those endpoints (CWE-863). Affected releases include Liferay Portal 7.4.0 through 7.4.3.109 and older unsupported versions, plus Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35. Exposure is sharply reduced where self-registration is disabled or accounts are admin-provisioned, and no public exploit was identified at time of analysis; EPSS is low at 0.22% (12th percentile).
Cross-site request forgery in Liferay Portal and Liferay DXP allows remote attackers to invoke arbitrary Headless API actions through the `endpoint` parameter when an authenticated victim visits attacker-controlled web content. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.107 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and the issue is moderate-priority because the attacker must first obtain an authenticated victim's interaction rather than invoking the API directly.
Password reset tokens in Liferay Portal and Liferay DXP are stored in cleartext in the backend database, so an attacker who already has database read access can obtain a token and use the standard reset flow to target individual user accounts. Affected releases include Liferay Portal 7.4.0 through 7.4.3.99 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions. There is no remote unauthenticated path (PR:H), no public exploit identified at time of analysis, and EPSS is 0.29% (20th percentile), consistent with a medium-severity, low-priority issue.
Denial of service in Liferay Portal and Liferay DXP allows authenticated low-privilege remote users to exhaust application resources by issuing Headless API requests that return an unbounded number of objects. Affected releases include Liferay Portal 7.4.0 through 7.4.3.99 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. Impact is availability-only; no public exploit identified at time of analysis, and EPSS is 0.39% (31st percentile).
Information disclosure in Liferay Portal and Liferay DXP's LDAP import feature causes user email addresses to be written to server log files, where a local user with high privileges can read them. Affected releases include Liferay Portal 7.4.0 through 7.4.3.97 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35, as well as older unsupported versions; the issue only manifests when LDAP import is configured and the attacker can access host logs. No public exploit code was identified at time of analysis, and EPSS is 0.14% (3rd percentile).
Stored cross-site scripting (XSS) in Liferay Portal 7.3.7 through 7.4.3.103 and the corresponding Liferay DXP releases (2023.Q3.1-Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36) lets an authenticated user who can create or edit an Account Role or an Organization persist a script/HTML payload in an Account Role 'Title' or an Organization 'Name' field, which then executes in the browser of any other user who opens the view or select pages for those records. Because the vector requires PR:L and UI:R - the attacker must already hold account/organization administration rights and a victim must actively navigate to the affected admin pages - impact is bounded to low-integrity, low-confidentiality actions in the victim's session with no availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.22% (12th percentile), consistent with a low-to-moderate priority issue rather than a critical emergency.
Open redirect in Liferay Portal and Liferay DXP page administration lets unauthenticated remote attackers send victims to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.97 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, but exploitation requires a victim to click a crafted link and then act on the destination, limiting impact to phishing-style redirection. No public exploit was identified at time of analysis and EPSS is low at 0.25% (15th percentile).
Unauthenticated remote attackers can make the Liferay Portal ComboServlet merge an unbounded number and size of files named in the URL query string, producing very large HTTP responses that degrade portal availability across Liferay Portal 7.4.0 through 7.4.3.111, older unsupported releases, and Liferay DXP 2023.Q4.0-2023.Q4.2, 2023.Q3.1-2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) confirms an availability-only, partial impact with no confidentiality or integrity loss, and no authentication, user interaction or non-default configuration is required beyond the ComboServlet being network-reachable. Risk is moderate rather than urgent: EPSS is 0.55% (45th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Self-cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated Knowledge Base editor store a crafted script or HTML payload in an attachment filename, which then executes in that same user's browser when the article edit page renders the filename. Affected releases are Liferay Portal 7.4.0 through 7.4.3.101, Liferay DXP 2023.Q3.1 through 2023.Q3.5 and 7.4 GA through update 92, and older unsupported versions; the CVSS 4.0 score is 2.0 and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. No public exploit has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.21% (11th percentile), consistent with a low-priority, self-contained XSS requiring authentication and user interaction.
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, and 7.3 GA through update 35 can expose their OpenAPI YAML specification when access restrictions are not properly enforced in certain circumstances. Unauthenticated remote attackers can retrieve the API description document through a crafted URL, gaining reconnaissance-level information but not write access, data modification, or code execution. No public exploit or CISA KEV confirmation is identified in the provided data, and EPSS is low at 0.40% (33rd percentile).
Missing authorization in the Collection Provider component of Liferay Portal 7.4.0 through 7.4.3.132 and multiple Liferay DXP 2024-2025.Q2 releases allows authenticated instance users to read and select Blueprints belonging to other instances in multi-tenant deployments. Exploitation requires a valid low-privileged account and user interaction, and impact is limited to confidentiality and integrity of Blueprint objects; the vendor CVSS 4.0 score is 2.0, EPSS is 0.27%, and no public exploit was identified at time of analysis.
Reflected cross-site scripting in Liferay Portal 7.4.0 through 7.4.3.132 and the Liferay DXP 2024.Q1 through 2025.Q2 quarterly release lines lets a highly privileged authenticated user inject JavaScript through the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter of the Dynamic Data Mapping portlet, which then executes in a victim's browser when that victim opens a crafted URL. Because the issue is described as a regression, instances that were previously patched against related DDM portlet XSS should not be assumed clean. Exploitation requires a high-privilege account (PR:H) plus deliberate victim interaction (UI:P), public exploit code has not been identified and there is no CISA KEV entry, with EPSS at 0.24% (14th percentile), so real-world urgency remains low.
Reflected cross-site scripting in Liferay Portal 7.4.0 through 7.4.3.132 and multiple Liferay DXP 2023.Q4 through 2025.Q3 quarterly releases allows remote unauthenticated attackers to inject JavaScript into the google_gadget feature; the payload executes in a victim's browser only after the victim follows a crafted link, so impact is limited to the victim's session context. No public exploit identified at time of analysis, no CISA KEV entry is present, and EPSS is low at 0.25% (15th percentile).
Liferay Portal and Liferay DXP fail to properly validate the origin and authenticity of cluster messages, allowing unauthenticated remote attackers with access to the cluster messaging channel to submit data that a node treats as trusted, with limited confidentiality and integrity impact. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.132 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35, plus older unsupported versions. Exploitation requires clustered mode and reachability to the cluster transport; EPSS is 0.17% and no public exploit was identified at time of analysis.
Information disclosure in Liferay Portal 7.3.0 through 7.4.3.119 and Liferay DXP 2023.Q3/Q4 and 7.3/7.4 GA-update ranges lets authenticated portal users view content they are not permitted to see through the Menu Display Widget. The flaw is limited to low confidentiality impact, with no modification or denial-of-service effect, and reachability depends on a deployed Menu Display Widget fronting permission-restricted content. EPSS is low at 0.27% (18th percentile), and no public exploit is identified at time of analysis.
Liferay Portal and Liferay DXP allow an authenticated user in one virtual instance to assign an organization to a user in a different virtual instance through an insecure direct object reference in the Users Admin portlet. Affected releases include Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, plus Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. The impact is integrity-only (CVSS 5.3, scope changed) and requires a valid authenticated account with access to the UsersAdminPortlet organization-assignment function; no public exploit has been identified at time of analysis, and EPSS is 0.27% (18th percentile).
Stored cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated user inject script or HTML through the first, middle, or last name profile fields, with the payload executing when another user views a mention or comment in features such as page comments, blog comments, document and media comments, message boards, or wiki page comments. Affected versions include Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, along with older unsupported releases. The CVSS 4.0 score is 4.8 with a low EPSS of 0.22%; no public exploit code or CISA KEV activity is identified at time of analysis, and exploitation requires an authenticated account plus victim interaction.
Authenticated Liferay users can exploit an insecure direct object reference in the Account Entries Admin portlet to read address records belonging to other accounts by manipulating the addressId parameter. The issue affects Liferay Portal 7.4.3.4 through 7.4.3.111 and multiple Liferay DXP 7.4 GA, 2023.Q3, and 2023.Q4 releases; impact is confidentiality-only, with no data modification or service disruption reported. EPSS is low at 0.30% (21st percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
Insecure direct object reference in Liferay Portal's Publications (change tracking) functionality lets a remote authenticated user view and edit publication comments belonging to other users by supplying a crafted value in the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter, which the portlet processes without an authorization check. Affected deployments are Liferay Portal 7.4.1 through 7.4.3.112 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and exploitation requires a valid portal account plus the Publications feature being enabled. Impact is limited to confidentiality and integrity of comment content with no availability effect, EPSS is low at 0.24% (14th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
An insecure direct object reference (IDOR) in the Publications portlet of Liferay Portal and Liferay DXP lets a signed-in user view the edit page of a change-tracking publication they are not authorized to see by tampering with the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter. Affected releases are Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 7.3 GA through update 36, 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5. Exploitation requires a valid authenticated account with access to the Publications feature and some user interaction, and the outcome is read-only disclosure of a publication's edit-page content - no data modification or availability impact - which is why EPSS is low (0.29%, 20th percentile) and no public exploit has been identified at time of analysis; no vendor-released patch version is specified in the available data, so the linked Liferay advisory should be treated as the authoritative source for fixed builds.
Cross-site request forgery in Liferay Portal 7.4.1 through 7.4.3.112 and in Liferay DXP (2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.10, and 7.4 GA through update 92) lets an attacker who can lure an already-logged-in user with comment privileges into loading attacker-controlled content silently create or modify publication comments in that user's session. Impact is integrity-only on the publications/comments feature - no data disclosure and no availability effect - and exploitation depends on victim interaction with a forged request, so this is a low-to-moderate priority issue despite its 5.1 CVSS 4.0 base score. EPSS is 0.19% (8th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in Liferay Portal's workflow process builder allows remote high-privilege authenticated users to inject script or HTML into workflow definitions, which executes when another user later views or renders the affected workflow element. Liferay Portal 7.4.3.21 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 are affected. EPSS is 0.22% (12th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Liferay DXP and Liferay Portal is a moderate-risk issue: an authenticated user with low privileges can persist script or HTML in an Account's “Name” field, which then executes when another user or administrator opens the Membership page in Account Settings. Affected releases include Liferay Portal 7.4.3.21 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92. No public exploit was identified at time of analysis; EPSS is 0.22%, and successful exploitation requires victim interaction and is scoped to the browser session.
Stored cross-site scripting in Liferay Commerce’s view order page allows an authenticated low-privileged user to inject arbitrary script or HTML into an Account’s “Name” field, which then executes when a store operator or administrator opens the affected account’s order. Liferay Portal 7.4.3.8 through 7.4.3.111 and Liferay DXP 2023.Q3.1-2023.Q3.8, 2023.Q4.0-2023.Q4.5, and 7.4 update 8 through update 92 are affected when the Commerce module is in use. No public exploit code or CISA KEV active exploitation is identified, and EPSS is low at 0.22%.
Stored cross-site scripting in Liferay DXP and Liferay Portal allows an authenticated low-privileged user to inject script or HTML into their First, Middle, or Last Name fields, which executes when another user views a Calendar event that renders the attacker's name. Affected deployments include Liferay Portal 7.4.3.35 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36. Exploitation requires victim interaction and an existing account, impact is scoped to the victim's browser session, EPSS is low at 0.22 percent, and no public exploit or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the Notifications widget of Liferay Portal 7.4.3.102 through 7.4.3.111 and Liferay DXP 2023.Q3/2023.Q4 allows an authenticated low-privileged user to inject script into profile name fields or content-flagging inputs, which then executes when a moderator or administrator views the notification. Exploitation depends on a valid account and victim interaction; EPSS is low at 0.21%, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Liferay DXP and Liferay Portal Forms allows remote attackers to inject arbitrary web script or HTML via a crafted payload in a rich-text-type form field, which executes in a victim's browser when the submission is viewed. Affected versions include Liferay Portal 7.3.2 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35. No public exploit code has been identified at the time of analysis, and the EPSS score is 0.24% (14th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in the Liferay Commerce diagram-type product feature lets a user who can author or edit Commerce products upload a crafted SVG that carries script, which then executes in the browser of anyone who views the affected diagram or product page. Exploitation requires an authenticated account with Commerce content-authoring permissions (PR:L) plus victim interaction (UI:R), and the impact is scoped to the victim's browser session (limited confidentiality and integrity, no availability impact). Risk is genuinely medium/low priority: the Commerce module with diagram-type products must be deployed, EPSS is only 0.22% (12th percentile), and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the Liferay Commerce Product Comparison Table widget affects Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5, letting an authenticated user who can create or edit Commerce Products inject arbitrary web script or HTML into a product's Name field so it executes in the browser of a victim who views the comparison table containing that product. Exploitation requires the Commerce module and this specific widget to be deployed, an attacker account with catalog-edit rights (PR:L), and victim interaction (UI:A/R); no public exploit identified at time of analysis and EPSS is 0.22% (12th percentile), making this a low-to-moderate priority stored XSS rather than a critical issue.
Stored cross-site scripting in Liferay Portal 7.4.3.15 through 7.4.3.111 and Liferay DXP 7.4/2023.Q3-Q4 lets an authenticated user who can edit Terms and Conditions names inject script that executes when another user views an order page. The attacker must have an account with privileges to set Payment Term or Delivery Term name fields, and a victim must load the affected view order page. No public exploit was identified at time of analysis; EPSS is 0.22% (12th percentile), and the issue is a low-to-moderate priority limited to script execution in the victim's browser.
Stored cross-site scripting in the Liferay Commerce Search Result widget lets authenticated users who can create or edit Commerce Products inject arbitrary script or HTML into a product's Name field, which then executes in another user's browser when that user views the affected search result. The issue affects Liferay Portal 7.4.0 through 7.4.3.111 and specified Liferay DXP 2023.Q3, 2023.Q4, and 7.4 GA update levels. EPSS is 0.22% (12th percentile), and the provided data contains no CISA KEV entry or public exploit code; exploitation also requires a victim to view the crafted search result, keeping real-world risk low to moderate.
The Profile widget in Liferay Portal 7.4.x and Liferay DXP 7.4 / 2023.Q3 / 2023.Q4 builds reflects a user-controlled profile name into the Content-Disposition header when a vCard file is downloaded, letting an authenticated user append a different file extension to the saved file. The impact is limited to filename/extension manipulation of the downloaded vCard - no code execution, no data disclosure, and no server-side compromise - and it only takes effect if a victim actually performs the download (CVSS 3.1: AV:N/AC:L/PR:L/UI:R, I:L only; EPSS ~0.23%, 13th percentile). There is no public exploit code or confirmed active exploitation, and despite the CWE-79 tag the behavior is better characterized as header/filename injection than cross-site scripting.
A security vulnerability in Liferay Portal 7.4.0 (CVSS 6.5) that allows sensitive user data. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4,. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35,. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes. Rated low severity (CVSS 1.0). No vendor patch available.
The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7,. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in Liferay Portal Community Edition (CE) versions prior to 7.2.1 CE GA2 allows unauthenticated remote attackers to run arbitrary Java code by abusing the JSON web services (JSONWS) interface. This flaw is confirmed actively exploited (CISA KEV) - it was leveraged by the 'FreakOut' botnet - with publicly available exploit code and an EPSS score of 99.78% (100th percentile), placing it among the most likely to be exploited vulnerabilities. It carries a CVSS 9.8, reflecting network-reachable, no-authentication, no-interaction exploitation with full confidentiality, integrity, and availability impact.
Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Liferay Portal 7.4.3.35-7.4.3.111 and Liferay DXP (2023.Q4.0-2023.Q4.10, 2023.Q3.1-2023.Q3.10, 7.4 update 35-92) lets an authenticated user who can modify First, Middle, or Last Name fields inject script that runs when a victim opens the web content template 'select structure' page. The vendor rates it CVSS 4.0 base 4.6 (medium); the independent assessment uses CVSS 3.1 with PR:L/UI:R/S:C and low confidentiality and integrity impact, with no availability effect. EPSS is 0.23% (13th percentile) and no public exploit or CISA KEV entry was identified at time of analysis.
Reflected cross-site scripting in Liferay Portal and Liferay DXP's Language Override portlet allows unauthenticated remote attackers to inject arbitrary web script or HTML through the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter, but exploitation requires the victim to click a crafted URL (UI:A). Affected deployments are Liferay Portal 7.4.3.8 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92; impact is limited to the victim's browser session with low confidentiality and integrity impact and no availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.24% (14th percentile).
Stored cross-site scripting in the Liferay Portal/DXP Blogs widget allows authenticated users with blog-content authoring rights to inject a crafted <iframe> into a blog entry's Content field, and the widget's failure to sandbox iframes can let the framed page access the parent page when a victim views the entry. It is rated CVSS 4.0 base 4.8 (Medium) and assessed as requiring authenticated blog-authoring access plus victim interaction, with impact limited to low confidentiality and integrity in the victim's browser context. No public exploit was identified at time of analysis, and there is no unauthenticated or default-configuration remote path described in the available data.
Liferay Portal and Liferay DXP expose an open redirect that can send users to attacker-chosen external sites when redirect URL security remains at its default IP-based validation. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.119 and Liferay DXP 7.4 GA through update 92, plus the listed 2023.Q3, 2023.Q4, and 2024.Q1 releases; remote unauthenticated attackers can exploit it through DNS rebinding, but a victim must click and follow the crafted redirect. No public exploit identified at time of analysis, and the issue is a medium-severity, low-priority open redirect rather than a code-execution or server-compromise flaw.
Password enumeration in Liferay Portal 7.4.0 through 7.4.3.119 and the listed Liferay DXP 2023.Q3 through 2024.Q1 quarterly releases lets unauthenticated remote attackers use sustained brute-force guessing to distinguish a correct password from an incorrect one even when account lockout is enabled, so the lockout control does not actually stop repeated authentication attempts. The exposure is an information leak rather than account takeover: an attacker who already knows or can enumerate a valid username can, given enough attempts, confirm or recover a weak password for that account. Attackers must be able to reach the authentication endpoint over the network, and success is probabilistic and highly dependent on password strength, so this is a medium-severity defense-in-depth issue (CVSS 4.0 base 6.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no CISA KEV listing.
Liferay Portal and Liferay DXP deployments can let a remote user who holds a registered but not-yet-verified account access and edit content through exposed APIs, because the platform does not enforce email-verification gating on those endpoints (CWE-863). Affected releases include Liferay Portal 7.4.0 through 7.4.3.109 and older unsupported versions, plus Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35. Exposure is sharply reduced where self-registration is disabled or accounts are admin-provisioned, and no public exploit was identified at time of analysis; EPSS is low at 0.22% (12th percentile).
Cross-site request forgery in Liferay Portal and Liferay DXP allows remote attackers to invoke arbitrary Headless API actions through the `endpoint` parameter when an authenticated victim visits attacker-controlled web content. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.107 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and the issue is moderate-priority because the attacker must first obtain an authenticated victim's interaction rather than invoking the API directly.
Password reset tokens in Liferay Portal and Liferay DXP are stored in cleartext in the backend database, so an attacker who already has database read access can obtain a token and use the standard reset flow to target individual user accounts. Affected releases include Liferay Portal 7.4.0 through 7.4.3.99 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions. There is no remote unauthenticated path (PR:H), no public exploit identified at time of analysis, and EPSS is 0.29% (20th percentile), consistent with a medium-severity, low-priority issue.
Denial of service in Liferay Portal and Liferay DXP allows authenticated low-privilege remote users to exhaust application resources by issuing Headless API requests that return an unbounded number of objects. Affected releases include Liferay Portal 7.4.0 through 7.4.3.99 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. Impact is availability-only; no public exploit identified at time of analysis, and EPSS is 0.39% (31st percentile).
Information disclosure in Liferay Portal and Liferay DXP's LDAP import feature causes user email addresses to be written to server log files, where a local user with high privileges can read them. Affected releases include Liferay Portal 7.4.0 through 7.4.3.97 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35, as well as older unsupported versions; the issue only manifests when LDAP import is configured and the attacker can access host logs. No public exploit code was identified at time of analysis, and EPSS is 0.14% (3rd percentile).
Stored cross-site scripting (XSS) in Liferay Portal 7.3.7 through 7.4.3.103 and the corresponding Liferay DXP releases (2023.Q3.1-Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36) lets an authenticated user who can create or edit an Account Role or an Organization persist a script/HTML payload in an Account Role 'Title' or an Organization 'Name' field, which then executes in the browser of any other user who opens the view or select pages for those records. Because the vector requires PR:L and UI:R - the attacker must already hold account/organization administration rights and a victim must actively navigate to the affected admin pages - impact is bounded to low-integrity, low-confidentiality actions in the victim's session with no availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.22% (12th percentile), consistent with a low-to-moderate priority issue rather than a critical emergency.
Open redirect in Liferay Portal and Liferay DXP page administration lets unauthenticated remote attackers send victims to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.97 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, but exploitation requires a victim to click a crafted link and then act on the destination, limiting impact to phishing-style redirection. No public exploit was identified at time of analysis and EPSS is low at 0.25% (15th percentile).
Unauthenticated remote attackers can make the Liferay Portal ComboServlet merge an unbounded number and size of files named in the URL query string, producing very large HTTP responses that degrade portal availability across Liferay Portal 7.4.0 through 7.4.3.111, older unsupported releases, and Liferay DXP 2023.Q4.0-2023.Q4.2, 2023.Q3.1-2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, 5.3) confirms an availability-only, partial impact with no confidentiality or integrity loss, and no authentication, user interaction or non-default configuration is required beyond the ComboServlet being network-reachable. Risk is moderate rather than urgent: EPSS is 0.55% (45th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Self-cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated Knowledge Base editor store a crafted script or HTML payload in an attachment filename, which then executes in that same user's browser when the article edit page renders the filename. Affected releases are Liferay Portal 7.4.0 through 7.4.3.101, Liferay DXP 2023.Q3.1 through 2023.Q3.5 and 7.4 GA through update 92, and older unsupported versions; the CVSS 4.0 score is 2.0 and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. No public exploit has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.21% (11th percentile), consistent with a low-priority, self-contained XSS requiring authentication and user interaction.
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, and 7.3 GA through update 35 can expose their OpenAPI YAML specification when access restrictions are not properly enforced in certain circumstances. Unauthenticated remote attackers can retrieve the API description document through a crafted URL, gaining reconnaissance-level information but not write access, data modification, or code execution. No public exploit or CISA KEV confirmation is identified in the provided data, and EPSS is low at 0.40% (33rd percentile).
Missing authorization in the Collection Provider component of Liferay Portal 7.4.0 through 7.4.3.132 and multiple Liferay DXP 2024-2025.Q2 releases allows authenticated instance users to read and select Blueprints belonging to other instances in multi-tenant deployments. Exploitation requires a valid low-privileged account and user interaction, and impact is limited to confidentiality and integrity of Blueprint objects; the vendor CVSS 4.0 score is 2.0, EPSS is 0.27%, and no public exploit was identified at time of analysis.
Reflected cross-site scripting in Liferay Portal 7.4.0 through 7.4.3.132 and the Liferay DXP 2024.Q1 through 2025.Q2 quarterly release lines lets a highly privileged authenticated user inject JavaScript through the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter of the Dynamic Data Mapping portlet, which then executes in a victim's browser when that victim opens a crafted URL. Because the issue is described as a regression, instances that were previously patched against related DDM portlet XSS should not be assumed clean. Exploitation requires a high-privilege account (PR:H) plus deliberate victim interaction (UI:P), public exploit code has not been identified and there is no CISA KEV entry, with EPSS at 0.24% (14th percentile), so real-world urgency remains low.
Reflected cross-site scripting in Liferay Portal 7.4.0 through 7.4.3.132 and multiple Liferay DXP 2023.Q4 through 2025.Q3 quarterly releases allows remote unauthenticated attackers to inject JavaScript into the google_gadget feature; the payload executes in a victim's browser only after the victim follows a crafted link, so impact is limited to the victim's session context. No public exploit identified at time of analysis, no CISA KEV entry is present, and EPSS is low at 0.25% (15th percentile).
Liferay Portal and Liferay DXP fail to properly validate the origin and authenticity of cluster messages, allowing unauthenticated remote attackers with access to the cluster messaging channel to submit data that a node treats as trusted, with limited confidentiality and integrity impact. Affected deployments include Liferay Portal 7.4.0 through 7.4.3.132 and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35, plus older unsupported versions. Exploitation requires clustered mode and reachability to the cluster transport; EPSS is 0.17% and no public exploit was identified at time of analysis.
Information disclosure in Liferay Portal 7.3.0 through 7.4.3.119 and Liferay DXP 2023.Q3/Q4 and 7.3/7.4 GA-update ranges lets authenticated portal users view content they are not permitted to see through the Menu Display Widget. The flaw is limited to low confidentiality impact, with no modification or denial-of-service effect, and reachability depends on a deployed Menu Display Widget fronting permission-restricted content. EPSS is low at 0.27% (18th percentile), and no public exploit is identified at time of analysis.
Liferay Portal and Liferay DXP allow an authenticated user in one virtual instance to assign an organization to a user in a different virtual instance through an insecure direct object reference in the Users Admin portlet. Affected releases include Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, plus Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. The impact is integrity-only (CVSS 5.3, scope changed) and requires a valid authenticated account with access to the UsersAdminPortlet organization-assignment function; no public exploit has been identified at time of analysis, and EPSS is 0.27% (18th percentile).
Stored cross-site scripting in Liferay Portal and Liferay DXP lets an authenticated user inject script or HTML through the first, middle, or last name profile fields, with the payload executing when another user views a mention or comment in features such as page comments, blog comments, document and media comments, message boards, or wiki page comments. Affected versions include Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, along with older unsupported releases. The CVSS 4.0 score is 4.8 with a low EPSS of 0.22%; no public exploit code or CISA KEV activity is identified at time of analysis, and exploitation requires an authenticated account plus victim interaction.
Authenticated Liferay users can exploit an insecure direct object reference in the Account Entries Admin portlet to read address records belonging to other accounts by manipulating the addressId parameter. The issue affects Liferay Portal 7.4.3.4 through 7.4.3.111 and multiple Liferay DXP 7.4 GA, 2023.Q3, and 2023.Q4 releases; impact is confidentiality-only, with no data modification or service disruption reported. EPSS is low at 0.30% (21st percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
Insecure direct object reference in Liferay Portal's Publications (change tracking) functionality lets a remote authenticated user view and edit publication comments belonging to other users by supplying a crafted value in the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter, which the portlet processes without an authorization check. Affected deployments are Liferay Portal 7.4.1 through 7.4.3.112 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and exploitation requires a valid portal account plus the Publications feature being enabled. Impact is limited to confidentiality and integrity of comment content with no availability effect, EPSS is low at 0.24% (14th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
An insecure direct object reference (IDOR) in the Publications portlet of Liferay Portal and Liferay DXP lets a signed-in user view the edit page of a change-tracking publication they are not authorized to see by tampering with the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter. Affected releases are Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 7.3 GA through update 36, 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5. Exploitation requires a valid authenticated account with access to the Publications feature and some user interaction, and the outcome is read-only disclosure of a publication's edit-page content - no data modification or availability impact - which is why EPSS is low (0.29%, 20th percentile) and no public exploit has been identified at time of analysis; no vendor-released patch version is specified in the available data, so the linked Liferay advisory should be treated as the authoritative source for fixed builds.
Cross-site request forgery in Liferay Portal 7.4.1 through 7.4.3.112 and in Liferay DXP (2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.10, and 7.4 GA through update 92) lets an attacker who can lure an already-logged-in user with comment privileges into loading attacker-controlled content silently create or modify publication comments in that user's session. Impact is integrity-only on the publications/comments feature - no data disclosure and no availability effect - and exploitation depends on victim interaction with a forged request, so this is a low-to-moderate priority issue despite its 5.1 CVSS 4.0 base score. EPSS is 0.19% (8th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in Liferay Portal's workflow process builder allows remote high-privilege authenticated users to inject script or HTML into workflow definitions, which executes when another user later views or renders the affected workflow element. Liferay Portal 7.4.3.21 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 are affected. EPSS is 0.22% (12th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Liferay DXP and Liferay Portal is a moderate-risk issue: an authenticated user with low privileges can persist script or HTML in an Account's “Name” field, which then executes when another user or administrator opens the Membership page in Account Settings. Affected releases include Liferay Portal 7.4.3.21 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92. No public exploit was identified at time of analysis; EPSS is 0.22%, and successful exploitation requires victim interaction and is scoped to the browser session.
Stored cross-site scripting in Liferay Commerce’s view order page allows an authenticated low-privileged user to inject arbitrary script or HTML into an Account’s “Name” field, which then executes when a store operator or administrator opens the affected account’s order. Liferay Portal 7.4.3.8 through 7.4.3.111 and Liferay DXP 2023.Q3.1-2023.Q3.8, 2023.Q4.0-2023.Q4.5, and 7.4 update 8 through update 92 are affected when the Commerce module is in use. No public exploit code or CISA KEV active exploitation is identified, and EPSS is low at 0.22%.
Stored cross-site scripting in Liferay DXP and Liferay Portal allows an authenticated low-privileged user to inject script or HTML into their First, Middle, or Last Name fields, which executes when another user views a Calendar event that renders the attacker's name. Affected deployments include Liferay Portal 7.4.3.35 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 update 35 through update 92, and 7.3 update 25 through update 36. Exploitation requires victim interaction and an existing account, impact is scoped to the victim's browser session, EPSS is low at 0.22 percent, and no public exploit or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the Notifications widget of Liferay Portal 7.4.3.102 through 7.4.3.111 and Liferay DXP 2023.Q3/2023.Q4 allows an authenticated low-privileged user to inject script into profile name fields or content-flagging inputs, which then executes when a moderator or administrator views the notification. Exploitation depends on a valid account and victim interaction; EPSS is low at 0.21%, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Liferay DXP and Liferay Portal Forms allows remote attackers to inject arbitrary web script or HTML via a crafted payload in a rich-text-type form field, which executes in a victim's browser when the submission is viewed. Affected versions include Liferay Portal 7.3.2 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35. No public exploit code has been identified at the time of analysis, and the EPSS score is 0.24% (14th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in the Liferay Commerce diagram-type product feature lets a user who can author or edit Commerce products upload a crafted SVG that carries script, which then executes in the browser of anyone who views the affected diagram or product page. Exploitation requires an authenticated account with Commerce content-authoring permissions (PR:L) plus victim interaction (UI:R), and the impact is scoped to the victim's browser session (limited confidentiality and integrity, no availability impact). Risk is genuinely medium/low priority: the Commerce module with diagram-type products must be deployed, EPSS is only 0.22% (12th percentile), and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the Liferay Commerce Product Comparison Table widget affects Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5, letting an authenticated user who can create or edit Commerce Products inject arbitrary web script or HTML into a product's Name field so it executes in the browser of a victim who views the comparison table containing that product. Exploitation requires the Commerce module and this specific widget to be deployed, an attacker account with catalog-edit rights (PR:L), and victim interaction (UI:A/R); no public exploit identified at time of analysis and EPSS is 0.22% (12th percentile), making this a low-to-moderate priority stored XSS rather than a critical issue.
Stored cross-site scripting in Liferay Portal 7.4.3.15 through 7.4.3.111 and Liferay DXP 7.4/2023.Q3-Q4 lets an authenticated user who can edit Terms and Conditions names inject script that executes when another user views an order page. The attacker must have an account with privileges to set Payment Term or Delivery Term name fields, and a victim must load the affected view order page. No public exploit was identified at time of analysis; EPSS is 0.22% (12th percentile), and the issue is a low-to-moderate priority limited to script execution in the victim's browser.
Stored cross-site scripting in the Liferay Commerce Search Result widget lets authenticated users who can create or edit Commerce Products inject arbitrary script or HTML into a product's Name field, which then executes in another user's browser when that user views the affected search result. The issue affects Liferay Portal 7.4.0 through 7.4.3.111 and specified Liferay DXP 2023.Q3, 2023.Q4, and 7.4 GA update levels. EPSS is 0.22% (12th percentile), and the provided data contains no CISA KEV entry or public exploit code; exploitation also requires a victim to view the crafted search result, keeping real-world risk low to moderate.
The Profile widget in Liferay Portal 7.4.x and Liferay DXP 7.4 / 2023.Q3 / 2023.Q4 builds reflects a user-controlled profile name into the Content-Disposition header when a vCard file is downloaded, letting an authenticated user append a different file extension to the saved file. The impact is limited to filename/extension manipulation of the downloaded vCard - no code execution, no data disclosure, and no server-side compromise - and it only takes effect if a victim actually performs the download (CVSS 3.1: AV:N/AC:L/PR:L/UI:R, I:L only; EPSS ~0.23%, 13th percentile). There is no public exploit code or confirmed active exploitation, and despite the CWE-79 tag the behavior is better characterized as header/filename injection than cross-site scripting.
A security vulnerability in Liferay Portal 7.4.0 (CVSS 6.5) that allows sensitive user data. Remediation should follow standard vulnerability management procedures.
Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4,. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35,. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes. Rated low severity (CVSS 1.0). No vendor patch available.
The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7,. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.