com.liferay.portal:com.liferay.portal.impl (Maven)
Advisories
19
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 109.1.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>com.liferay.portal.impl</artifactId><version>109.1.0</version></dependency>gradle
implementation("com.liferay.portal:com.liferay.portal.impl:109.1.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header |
Medium EPSS 0.13% |
< 69.1.0 | 69.1.0 |
| GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text |
Medium EPSS 0.29% |
< 92.0.2 | 92.0.2 |
| GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination |
High EPSS 0.55% |
< 97.0.0 | 97.0.0 |
| GHSA-rx48-gqc2-4w47 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget |
Medium EPSS 0.25% |
<= 114.1.0 | No fix yet |
| GHSA-pfwq-mr9g-gq6m Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key |
Medium EPSS 0.27% |
< 99.0.0 | 99.0.0 |
| GHSA-2hm7-r8f3-423h Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet |
High EPSS 0.50% |
< 96.0.0 | 96.0.0 |
| GHSA-697h-3q6m-jwp4 Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability |
Medium EPSS 0.18% |
< 101.0.0 | 101.0.0 |
| GHSA-95h4-8mqc-4mpf Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC |
High EPSS 0.40% |
< 101.0.0 | 101.0.0 |
| GHSA-xvgg-9h29-4g34 Liferay Portal has Improper Validation of Specified Quantity in Input |
High EPSS 0.40% |
< 96.0.0 | 96.0.0 |
| GHSA-r45v-2289-jgr4 Liferay Portal has stored cross-site scripting (XSS) vulnerability |
Medium EPSS 0.23% |
< 99.0.0 | 99.0.0 |
| GHSA-cv9j-mg9w-v7wm Liferay Portal JSONWS API endpoint shares sensitive information |
High EPSS 0.32% |
< 108.1.1 | 108.1.1 |
| GHSA-222w-xmc5-jhp3 Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability |
Medium EPSS 0.22% |
>= 7.0.4, < 109.1.0 | 109.1.0 |
| GHSA-mh9r-9pcx-rx55 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page |
High EPSS 0.28% |
< 5.25.0 | 5.25.0 |
| GHSA-9427-7f65-88c8 Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled |
Medium EPSS 0.54% |
< 8.0.0 | 8.0.0 |
| GHSA-vwj8-4grf-3r8v Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use |
High EPSS 1.20% |
< 5.7.3 | 5.7.3 |
| GHSA-jfch-m2x3-2v66 Liferay Portal and Liferay DXP insecure default configuration |
High EPSS 1.43% |
< 5.11.0 | 5.11.0 |
| GHSA-vrwx-q9pj-x488 Liferay Portal and Liferay DXP Bypass via Double Encoded URL |
Medium EPSS 1.22% |
< 7.1.3 | 7.1.3 |
| GHSA-vrwx-q9pj-x488 Liferay Portal and Liferay DXP Bypass via Double Encoded URL |
Medium EPSS 1.22% |
>= 7.2.0, < 7.4.0 | 7.4.0 |
| GHSA-822f-jfpg-hg7h Liferay Portal and Liferay DXP fails to check permissions to view sites/groups |
Medium EPSS 0.75% |
< 7.7.9 | 7.7.9 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor