Site Search - Liferay Learn

Security Vulnerability CVE-2023-28708

Issue This security vulnerability (CVE-2023-28708) has been reported, and it is fixed in Tomcat 9.0.72. However, our current Liferay DXP 7.3 SP1 has a 9.0.40 Tomcat version. Environment Liferay DXP 7.3 Resolution To mitigate this vulnerability, update Liferay DXP 7.3 to Liferay 7.3...

Can we obfuscate HTML of the sites?

legacy

Issue I would like to increase our protection from man in the middle attacks by obfuscating our site's HTML. Is there a method for this already implemented in Liferay? Environment DXP 7.0+ Resolution There is no obfuscation performed, and implementing it is not under consideration....

/language showing 403 forbidden url

legacy Troubleshooting

Issue When the user tries to access the URL: 'http://localhost:8080/language', even if the language page doesn't exist, it shows a 403 Forbidden error on UI instead of a 404 page not found. Logs error: ERROR [WebContainer : 19][LanguageServlet:64] Invalid authentication token received...

Error "Invalid site key" when using reCAPTCHA v3

legacy Troubleshooting

Issue When configuring reCAPTCHA v3 and testing it on the "Forgot Password" page, the following error message is reported: "ERROR for site owner: Invalid site key". Environment Liferay DXP 7.2+ Resolution Liferay does not currently support reCAPTCHA v3. To solve the issue, configure...

Error: Only known users are allowed to sign in using OpenID Connect.

legacy Troubleshooting

Issue You might encounter an error when using OpenID Connect, and users who are not yet been registered to Liferay are unable to login as they are identified as strangers. The error appears as the company.security.strangers is set to false You can also check this on the UI, by navigating...

X-Xss-Protection response header is not working in DXP 7.4

legacy

Issue To enable X-Xss-Protection, add the below property in system-ext.properties http.header.secure.x.xss.protection=1; mode=block and restarted the server. But it is not working in the Liferay. Environment Liferay DXP 7.4 Resolution The HTTP header X-XSS-Protection set to 1 by default...

How to enable cookies and the banner, consent panel

legacy How To

Issue How to enable the cookie preference handling as well as the configuration options for both the banner and the consent panel. Environment Liferay DXP 7.4 Resolution This feature was introduced in the Liferay DXP 7.4 update 66. To enable this option, follow the below steps: Navigate...

SAML Sessions remain Active despite Logout in Liferay

legacy Troubleshooting

Issue We have integrated SAML with our Liferay configuration. We have noticed that after a User logs out, their session remains active in Liferay. Environment Liferay DXP 7.3 Resolution This issue may occur if the 'SameSite' attribute in the browser cookie is set to 'Strict'. To resolve...

p_auth token missing from GET request

legacy

Issue After enabling CSRF Tokens, a p_auth token is appended to URLs, as expected. However, we noticed that if we manually remove this from the end of a URL and hit enter, we are still able to access the page, even though p_auth is now missing from the request. Does this mean CSRF...

After enabling LDAP authentication, administrator users who do not exist in LDAP can log in

legacy

Issue We have enabled LDAP authentication, checking it as required and we have unchecked Ignore User Search Filter for Authentication. With this configuration applied the administrator users can login even if they do not exist in LDAP. Environment DXP 7.4 Resolution This is the expected...

Setting sameSite attribute in Cookie for header response on JBoss EAP 7.2

legacy How To

Issue How to add the sameSite attribute as 'Strict' on the cookies JSESSIONID,COOKIE_SUPPORT,GUEST_LANGUAGE_ID on JBoss EAP 7.2 Environment Liferay DXP 7.4 JBoss EAP 7.2 Resolution In JBoss, navigate to jboss/standalone/configuration/standalone.xml. Edit standalone.xml and...

Requests to Liferay with an invalid HOST request HTTP header returns the default site

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue Requests to Liferay with an invalid HOST request HTTP header that does not match a configured Site URL returns the default site...

Access-control-allow-origin CORS Header not honoring System setting Configuration

legacy

Issue When configuring CORS headers in System Settings we are seeing that access-control-allow-origin header doesn't always have the configured value. Environment Liferay DXP 7.4 Resolution According to the specification, if the request is valid for cors and it has a "Origin" header,...

Security Managers, Vul ID: V-222936 STIG

legacy

Issue Vul ID: V-222936 STIG is flagged when Java Security Managers are not enabled. It states that "The Java Security Manager must be enabled." Environment DXP 7.1 Resolution Liferay DXP does not currently support enabling a security manager, and there are currently no alternative...

Vulnerability issues related to the EJS version in Fragments Toolkit

legacy Troubleshooting

Issue Vulnerability issues (ejs template injection vulnerability) were reported related to the EJS version inside the yarn.lock file while building fragments using the fragments toolkit. The EJS version is below 3.1.9 in many places in this yarn.lock file. Environment Liferay DXP 7.4...

Duplicate user errors when setting up a SAML Authentication to replace an existing Token-Based SSO

legacy Troubleshooting

Issue When trying to set up a SAML authentication to replace existing Token-Based SSO, there are errors that populate stating that the user and/or email address is already in use. A user with company 1xxxx and email address test@liferay.com is already in use Updating the email address...

Can I integrate an additional Captcha Engine?

legacy

Issue Currently, Liferay offers 2 Captcha Engines out of the box: Simple Captcha and Google reCaptcha 2 We would like to use another Captcha service. Environment Liferay DXP 7.4 Resolution At the moment it is not possible to integrate another Captcha Engine out of the box. There is...

Malware detected in Liferay Bundle - eicar.jpg

legacy

Issue We were notified of a possible malware infection. The location is my extracted source code of a Liferay DXP bundle. The file in question is eicar.jpg Environment Liferay DXP 7.4 Resolution EICAR files can be used to verify antivirus integration, and to see if the AV correctly picks...

The Liferay is vulnerable to the CVE-2023-4863?

legacy

Issue How can I mitigate vulnerability with CVE-2023-4863 regarding Liferay DXP? Environment All environments. Resolution Liferay does not use the libwebp library, so are not vulnerable to CVE-2023-4863. Additional Information CVE-2023-4863, content:...

Is Liferay vulnerable to CVE-2023-33946

legacy Troubleshooting

Issue I would like to know if Liferay is vulnerable to CVE-2023-33946? Environment Liferay DXP 7.4 U1-U48 Resolution Yes, the Liferay is vulnerable to this CVE, the resolution is update to Liferay 7.4 U49 (or higher) Or create a hotfix with the following LSV-1154 Additional Information...

Does Apache Log4j Vulnerability CVE-2021-44832 affect Liferay ?

legacy Troubleshooting

Issue The Liferay uses the log4j-core Library which was reported to have a vulnerability. Environment Liferay DXP 7.1 Liferay DXP 7.2 until fix-pack 16 Liferay DXP 7.3 until SP3 Resolution Yes, the Liferay is vulnerable to this CVE in the versions mentioned above, the resolution is...

LDAP Related Queries

legacy

Issue If the password is changed in the Active Directory, the user will still be able to log in to DXP? If we delete the user from Active Directory, the user will still be able to log in to DXP? How to import/ export the users from LDAP Directory to Liferay DB and vice versa. How users...

Will a curl vulnerability impact Liferay DXP?

legacy

Issue There have been security announcements that are deemed to be a high-risk vulnerability that is caused by curl 8.4.0. Environment DXP 7.3 Resolution Liferay DXP does not use the libcurl library. In conclusion, Liferay DXP is not vulnerable to this type of curl security...

Is it Liferay vulnerable to the Log4j Vulnerability CVE-2019-17571?

legacy

Issue After search in the following folder:/tomcat/webapps/ROOT/WEB-INF/lib/log4j-extras.jar is notice that the log4 is available as part of product, so the Liferay is it vulnerable to this lib? Environment All environments Resolution By default Liferay don't use the SocketServer class...

Setting up Liferay as both IDP and SP (SAML)

legacy How To

Issue This article outlines how to configure two Liferay DXP bundles for SAML authentication with one functioning as the Service Provider (SP) and the second as the Identity Provider (IdP). Environment DXP 7.4 Resolution Note: The below steps are for testing purposes only. Extract two...

Updating React dependencies to later version

legacy

Issue As part of the security audit, the old version of the React might be vulnerable to attacks. Is there a way to hide the React version that Liferay displays? Environment Liferay DXP 7.3 Resolution At this point of writing this article, Liferay is using React version 16.12.0 and is in...

Vulnerability in CKeditor 4.18.0

legacy Troubleshooting

Issue In Liferay, a vulnerable version of CKEditor 4.18.0 is being used. The vulnerability CVE-2023-28439 is present in the CKEditor versions less than 4.21.0. Environment Liferay DXP 7.0+ Resolution The observed behavior is a known issue addressed by the LPS-196513. Additional...

Nested Azure AD Groups are not assigned to Liferay groups

legacy Troubleshooting

Issue You want to assign Liferay user groups via dynamic Azure AD groups when logging in with SAML. For this, certain rules of Azure AD groups are in place based on your needs. There might be an issue where nested groups are not associated correctly in case you use Graph API's memberOf...

Differentiate multiple Identity Provider when click on the Sign-in button

legacy

Issue How the user can login to specific IDP when multiple IDPs are configured on the portal? Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution While using multiple IDPs, as soon as the user clicks on Sign-in button, it gives the list...

Is SELinux compatible with Liferay DXP 7.4?

legacy

Issue Is SELinux configuration compatible with Liferay DXP 7.4? Environment Liferay DXP 7.4 Running on one of the supported Operating Systems Resolution It is possible to set up SELinux to work with Liferay DXP 7.4 It is up to the customer to create the correct configuration that works...

Insecure Cross Document Messaging

legacy Troubleshooting

Issue Cross Document Messaging (also known as Web Messaging) introduced the postMessage() method, with which plaintext messages can be sent cross-origin. It consists of two parameters: “message”, and “targetOrigin”. If "targetOrigin" is set to ''*" this indicates that it can disclose the...

CSP headers are not working on DXP-7.4

legacy Troubleshooting

Issue Trying to attempt to work with the CSP feature, which is present in update 90 under feature flags, but users are still experiencing issues where they are unable to edit the page and it is continuously loading. Navigate to Control Panel> Instance Setting> Features Flag -> Enabled...

High CPU utilisation while using script to login users continuously

legacy Troubleshooting

Issue Facing high CPU utilization while logging-in high number of users per minute continuously (24x7) using username-password authentication, mostly while fetching data using some scripts. Environment Liferay DXP 7.0+ Resolution Password hashing is a costly operation, as it uses high...

How to implement a token system instead of using credentials to access remote services

legacy How To

Issue Trying to write a custom remote service using Liferay (ServiceImpl file), so which method may be used to authenticate using a token rather than credentials? Environment Liferay DXP 7.4 Resolution Liferay has Authentication Verifiers that authenticate remote invocations of Liferay...

Is There A Way To Verify ClamAV Integration With Liferay?

legacy Troubleshooting

Issue We followed the instructions below to enable document virus scanning, but we do not see any way to confirm the ClamAV integration was successful or that file scans are occurring when new files are uploaded to Documents and Media. Is there a way to validate the ClamAV - Liferay...

ORA-12899 because OpenID access token is too large

legacy

Issue We store several things in our OpenID access token and when a user tries to log in, it fails because the token size exceeds the 3000-character limit specified in the ACCESSTOKEN column of the OPENIDCONNECTSESSION table Environment Liferay DXP 7.2+ Oracle database Resolution The...

AntiSamy sanitizer cleans some of the HTML tags and styles, how can we solve that?

legacy Troubleshooting

Issue We turned on AntiSamy but it removes certain HTML code and CSS styles from our Web Content articles. Environment DXP 7.0+ Resolution Usage of HTML and CSS in Web Content article HTML fields Web content articles are not really intended to be used like this - they should not replace...

How is AntiSamy configured?

legacy

Issue We configured AntiSamy to santize Web Content articles. We would like to understand how AntiSamy works and what parts are expected to be removed in Web Content articles. Environment DXP 7.0+ Resolution In the article How to configure validation directives in AntiSamy, you can find...

Can Liferay Support SP and IDP initiated SAML Simultaneously?

legacy

Issue Our team is the design phase for authentication and we want to know if Liferay supports IDP and SP initiated SAML logins at the same time? Environment DXP 7.4 Resolution No, a single instance should not be both an IDP and a SP. With Liferay, you are either an IDP or an SP. For...

Force Authentication in SAML requiring reauthentication in SP

legacy How To

Issue With SAML and Force Authentication enabled, I am required to reauthenticate requests from the SP Environment DXP 7.3, 7.4 Resolution This behavior is intended, but to avoid manual reauthentication in this scenario, disable the Force Authentication setting. Additional Information...

Captcha authentication via Headless API

legacy

Issue We have developed a Liferay fragment to collect user input via a custom-designed HTML form. This fragment interacts with custom Liferay objects through a Headless API using JS We have created a new role with the necessary permissions to access the Headless API endpoints for...

How long does the content remain in the CDN cache?

legacy

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue What is the policy for cleaning and updating content stored on the CDN cache? Environment Liferay PaaS Resolution The CDN avaliable...

Is there a way identify When was the user Deactivated and by Whom?

legacy How To

Issue Is there a possible way to find out when was the exact date the Liferay user was deactivated and by whom? Environment Liferay DXP 7.3 Liferay DXP 7.4 Resolution Please run the attached Groovy script to get a full list of deactivated users: ListDeactivatedUsers.groovy Additional...

How can I access OpenIdConnectProvider classes in 7.4 U34+?

legacy How To

Issue The Liferay classes com.liferay.portal.security.sso.openid.connect.OpenIdConnectProvider; and com.liferay.portal.security.sso.openid.connect.OpenIdConnectProviderRegistry; were removed in U34+ by LPS-150092. How can I replace them in my customization? Environment DXP 7.4...

Security Issue Concerning Google Guava Versions 1.0 to 32

legacy How To

Issue There is a present vulnerability with Google Guava that affects the versions from 1.0 to 31.1. Liferay is currently bundled with Guava. It has been reported that osb-distributed-messaging-google-pubsub-connector declares a dependency on Guava 30.1.1 which has a known vulnerability...

User enumeration attack via response time

legacy Troubleshooting

Issue It is possible to determine if an email address is valid or not (i.e., user enumeration) by comparing the request's response time. This can be done by checking the browser's network tab and comparing the response time when valid parameters are passed to when they are not....

How do we Toggle Requirement for Strangers to Verify their Email Address

legacy How To

Issue How do we toggle the requirement for strangers to verify their email address Environment DXP 7.4 Resolution This setting can be toggled by going to: Instance Settings > User Authentication. From here, you can toggle the tickbox for "Require Strangers to Verify their Email...

Checking for vulnerability to CVE-2022-42889

legacy Troubleshooting

Issue Is our Liferay instance vulnerable to CVE-2022-42889? Environment DXP 7.4, DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution Look for commons-text in ${liferay.home}/license/versions.html, if you do not find it, you are not vulnerable to this CVE. If you do find it, contact Liferay...

How to test for vulnerabilitity to CVE-2020-7961

legacy How To

Issue We would like to determine if we are vulnerable to CVE-2020-7961. Environment DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution The steps to test for vulnerability to CVE-2020-7961 are as follows: 1. Start your Liferay bundle 2. Open a new terminal window and ran the following...

How to reduce difficulty on captcha for Liferay DXP 7.2

legacy Troubleshooting

Issue The captcha generated in the login is unreadable, even for humans. Environment Liferay DXP 7.2 Resolution Go to System Settings > Security Tools. Find and delete the following properties: nl.captcha.gimpy.FishEyeGimpyRenderer nl.captcha.gimpy.ShearGimpyRenderer , content:...

Relay state exceeds 80 bytes

legacy Troubleshooting

Issue After configuring SAML, I see Relay state exceeds 80 bytes WARN messages in the logs. How can I prevent the transmission of relay states larger than 80 bytes? Environment DXP 7.X Resolution This issue was resolved by LPS-76246. Please open a support ticket to request a hotfix...

CVE-2020-28885 and CVE-2020-28884

legacy

Issue We would like to know about Liferay's vulnerability to CVE-2020-28885 and CVE-2020-28884. The CVE's claim that it is a vulnerability for an Administrator User to be able to inject commands through the Gogo Shell module and Groovy scripts, respectively, to execute any OS command on...

CVE-2023-33950

legacy Troubleshooting

Issue We would like to determine whether Liferay is vulnerable to CVE-2023-33950 The CVE claims that Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allow regular expressions that are vulnerable to ReDoS attacks to be used as...

Is Liferay vulnerable to CVE-2023-40371 and CVE 2023-38408?

legacy

Issue Is Liferay vulnerable to any of these vulnerabilities? Environment DXP 6.2+ Resolution No, Liferay is not vulnerable to any of these two. Neither CVE relates to any Liferay features, so they do not affect Liferay portal. Additional Information Please check...

How to verify the current Implementation version of log4j.jar file

legacy How To

Issue We would like to verify the implementation version of a log4j.jar file, either to verify the application of an update or to assess current vulnerability. Environment DXP 7.3, DXP 7.4 Resolution You can find the current implementation version of log4j. jar file by: 1. Opening the...

Does Liferay support more than one SAML connection?

legacy

Issue Can Liferay connect to more than one Service or Identity Provider? Environment DXP 7.0 DXP 7.1 DXP 7.2 DXP 7.3 DXP 7.4 Resolution Yes, Liferay does support more than one SAML or Identity Provider connection. Additional Information...

How can we set the requireSSL property?

legacy How To

Issue How can we enable the requireSSL attribute in Liferay? Environment Liferay DXP 7.0+ Resolution You can set that in your JDBC properties: jdbc.default.url=jdbc:mysql://host/db?useUnicode=true&characterEncoding=UTF-8&useFastDateParsing=false&useSSL=true&requireSSL=true You can also...

Does having a script in the Analytics section qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in the Matomo (DXP 7.4) or Piwiki (DXP 7.0-7.3) field where the code can be executed on every other page Go to a Site's Configuration -> Site Settings -> Analytics Under the Matomo or Piwik fields, paste something like: "><img src=x onerror=alert(origin)>...

SSO SP connection doesn't send unauthenticated users to /c/portal/login

legacy How To

Issue Once we setup a SAML SP connection, the SAML adapter doesn't recognize unauthenticated users and redirect them to /c/portal/login Environment DXP 7.4 Resolution This is intended behavior with the “Prompt Enabled” flag unchecked (unchecked by default). To change this behavior,...

User is redirected to the 404 page instead of the login page when the session expires.

legacy How To

Issue The user is not prompted for login but to a 404 page when navigating in pages with restricted access if the user session expires or, if the user is not logged in and tries to access directly the url. Environment DXP 7.4 Resolution We disable this feature, that is present in former...

Search Results