Liferay Portal vulnerabilities
319 known vulnerabilities affecting liferay/liferay_portal.
Total CVEs
319
CISA KEV
1
actively exploited
Public exploits
11
Exploited in wild
3
Severity breakdown
CRITICAL8HIGH47MEDIUM259LOW5
Vulnerabilities
Page 15 of 16
CVE-2025-62248P4MEDIUMCVSS 4.8≥ 7.4.0, ≤ 7.4.3.1322025-10-22
CVE-2025-62248 [MEDIUM] CWE-79 CVE-2025-62248: A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identif
A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remot
nvd
CVE-2025-43794P4MEDIUMCVSS 4.8fixed in 7.4.3.1122025-09-15
CVE-2025-43794 [MEDIUM] CWE-79 CVE-2025-43794: Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers with the instance administrator role to inject arbit
nvd
CVE-2011-1502P4MEDIUMCVSS 4.0≥ 6.0.0, ≤ 6.0.52011-05-07
CVE-2011-1502 [MEDIUM] CWE-200 CVE-2011-1502: Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote
Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
nvd
CVE-2021-33327P4MEDIUMCVSS 4.3≥ 7.2.0, < 7.3.42021-08-03
CVE-2021-33327 [MEDIUM] CWE-276 CVE-2021-33327: The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
nvd
CVE-2021-33334P4MEDIUMCVSS 4.3≥ 7.0.0, < 7.3.32021-08-03
CVE-2021-33334 [MEDIUM] CWE-276 CVE-2021-33334: The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fi
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms
nvd
CVE-2021-29052P4MEDIUMCVSS 4.3≥ 7.3.0, ≤ 7.3.52021-05-17
CVE-2021-29052 [MEDIUM] CWE-276 CVE-2021-29052: The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.
nvd
CVE-2022-42126P4MEDIUMCVSS 4.3≥ 7.3.5, < 7.4.3.292022-11-15
CVE-2022-42126 [MEDIUM] CWE-284 CVE-2022-42126: The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before upda
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.
nvd
CVE-2023-33947P4MEDIUMCVSS 4.3≥ 7.4.3.4, ≤ 7.4.3.602023-05-24
CVE-2023-33947 [MEDIUM] CWE-284 CVE-2023-33947: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 d
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
nvd
CVE-2022-42129P4MEDIUMCVSS 4.3≥ 7.3.2, < 7.4.3.52022-11-15
CVE-2022-42129 [MEDIUM] CWE-639 CVE-2022-42129: An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Lifer
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
nvd
CVE-2025-43739P4MEDIUMCVSS 4.3≥ 7.4.3.94, ≤ 7.4.3.1322025-08-19
CVE-2025-43739 [MEDIUM] CWE-203 CVE-2025-43739: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 throu
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to
nvd
CVE-2025-62244P4MEDIUMCVSS 4.3≥ 7.3.1, < 7.4.3.1122025-10-13
CVE-2025-62244 [MEDIUM] CWE-639 CVE-2025-62244: Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 throug
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_
nvd
CVE-2025-43810P4MEDIUMCVSS 4.3≥ 7.2.0, < 7.4.3.1132025-09-22
CVE-2025-43810 [MEDIUM] CWE-639 CVE-2025-43810: Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via
nvd
CVE-2016-10404P4MEDIUMCVSS 6.1≤ 7.02017-08-07
CVE-2016-10404 [MEDIUM] CWE-79 CVE-2016-10404: XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundati
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
nvd
CVE-2017-12647P4MEDIUMCVSS 6.1≤ 7.02017-08-07
CVE-2017-12647 [MEDIUM] CWE-79 CVE-2017-12647: XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
nvd
CVE-2022-42131P4MEDIUMCVSS 4.8≥ 7.1.0, < 7.4.3.42022-11-15
CVE-2022-42131 [MEDIUM] CWE-295 CVE-2022-42131: Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Map
Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
nvd
CVE-2023-33946P4MEDIUMCVSS 4.3≥ 7.4.3.4, ≤ 7.4.3.482023-05-24
CVE-2023-33946 [MEDIUM] CWE-284 CVE-2023-33946: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 d
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
nvd
CVE-2022-42130P4MEDIUMCVSS 4.3≥ 7.1.0, < 7.4.3.52022-11-15
CVE-2022-42130 [MEDIUM] CWE-276 CVE-2022-42130: The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
nvd
CVE-2023-3426P4MEDIUMCVSS 4.3≥ 7.4.3.81, ≤ 7.4.3.852023-08-02
CVE-2023-3426 [MEDIUM] CWE-425 CVE-2023-3426: The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
nvd
CVE-2025-43736P4MEDIUMCVSS 4.3≥ 7.4.3.0, ≤ 7.4.3.1322025-08-12
CVE-2025-43736 [MEDIUM] CWE-770 CVE-2025-43736: A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.
A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile pictur
nvd
CVE-2025-43788P4MEDIUMCVSS 4.3≥ 7.4.3.81, ≤ 7.4.3.85≥ 7.4.3.94, < 7.4.3.1252025-09-12
CVE-2025-43788 [MEDIUM] CWE-862 CVE-2025-43788: The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 throu
The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
nvd