Site Search - Liferay Learn

Is Liferay vulnerable to CVE-2023-40371 and CVE 2023-38408?

Issue Is Liferay vulnerable to any of these vulnerabilities? Environment DXP 6.2+ Resolution No, Liferay is not vulnerable to any of these two. Neither CVE relates to any Liferay features, so they do not...

How to verify the current Implementation version of log4j.jar file

legacy How To

Issue We would like to verify the implementation version of a log4j.jar file, either to verify the application of an update or to assess current vulnerability. Environment DXP 7.3, DXP 7.4 Resolution You can find the...

Does Liferay support more than one SAML connection?

legacy

Issue Can Liferay connect to more than one Service or Identity Provider? Environment DXP 7.0 DXP 7.1 DXP 7.2 DXP 7.3 DXP 7.4 Resolution Yes, Liferay does support more than one SAML or Identity Provider...

Does having a script in the Analytics section qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in the Matomo (DXP 7.4) or Piwiki (DXP 7.0-7.3) field where the code can be executed on every other page Go to a Site's Configuration -> Site Settings -> Analytics Under the...

How can we set the requireSSL property?

legacy How To

Issue How can we enable the requireSSL attribute in Liferay? Environment Liferay DXP 7.0+ Resolution You can set that in your JDBC properties:...

SSO SP connection doesn't send unauthenticated users to /c/portal/login

legacy How To

Issue Once we setup a SAML SP connection, the SAML adapter doesn't recognize unauthenticated users and redirect them to /c/portal/login Environment DXP 7.4 Resolution This is intended behavior with the “Prompt Enabled”...

User is redirected to the 404 page instead of the login page when the session expires.

legacy How To

Issue The user is not prompted for login but to a 404 page when navigating in pages with restricted access if the user session expires or, if the user is not logged in and tries to access directly the url. ...

What should be done when answers to the security questions are forgotten?

legacy How To

Issue My users keep forgetting their answers to the security questions is there a way to disable this? Also is there an alternative to the forgot password option? Environment DXP 7.4 Resolution Liferay already sends a...

0Auth2.0 issues new token every time even before token's expiration time

legacy

Issue The access_token expiration default is set to 10 minutes. When invoking the /oauth2/token before the previous token expires, a brand new token is issued instead of the original token. Environment DXP 7.4...

Does having a script in a fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in a fragment's HTML section where the code can be executed, when the fragment is opened, like <img src=x onerror="alert(document.cookie)"> Can that be a vulnerability to...

Does having a script in a button fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put a Javascript code in the Button fragment's URL field, so it can be executed when we click on the button, like javascript:alert(document.cookie) Can that be a vulnerability to Cross Site...

Unable to process SAML request

legacy Troubleshooting

Issue Some users are unable to login via SAML Steps to reproduce: Login User for the first time The user gets logged-in successfully Now, log out and try logging in again Result: Throws unable to process SAML...

After configuring a CDN, Liferay does not load images and throws error in browser console

legacy Troubleshooting

Issue We have configured a CDN with our Liferay environment. The portal is unable to load Liferay JS/CSS and images and we see errors in the browser console: Access to XMLHttpRequest at 'https...(CDN)' from origin...

Liferay accepts only fully signed SAML responses. Can this requirement be turned off?

legacy

Issue From a security standpoint, it's a best practice to sign the Response. However, we can switch off this requirement in our other apps. I can understand that Liferay by default requires the complete signature of...

Does CVE-2022-1471 affects DXP 7.4?

legacy Troubleshooting

Issue Our scanner reported that the Liferay DXP image as well as the Elasticsearch image are vulnerable to CVE-2022-1471, which is about an issue with SnakeYaml. Could you please confirm if we have to address this...

Unable to embed widgets even with "Allow users to add to any website" enabled

legacy Troubleshooting

Issue I cannot embed widgets on another site (with a different domain) even though I have the checkbox "Allow users to add <portlet> to any website" enabled. "<Hostname> refused connection" error may be seen. ...

Observing 'Your connection is not private' Warning on Help Center Downloads

legacy Troubleshooting

Issue When trying to download a quarterly release from Liferay's Help Center we are getting a browser error that says 'Your connection is not private... Attackers might be trying to steal your information...'...

Is Liferay Affected by CVE-2023-49070?

legacy

Issue How can I mitigate vulnerability with CVE-2023-49070 regarding Liferay DXP? Environment All environments. Resolution Liferay does not use the Apache OFBiz, so Liferay is not impacted by this vulnerability....

LOGOUT event is not added to Audit Table

legacy Troubleshooting

Issue LOGOUT event is not being audited when SAML SLO is enabled. Environment Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution This happens because LogoutPreAction and LogoutPostAction classes do not get...

Critical Remote Code Execution Backdoor Vulnerability

legacy

Issue A critical remote code Backdoor vulnerability was discovered on the open source XZ utils. This is CVE-2024-3094 with a maximum CVSS3 score of 10.0 Environment Liferay DXP 7.4 Resolution The Docker images,...

Search Results