Issue
-
Some monitoring tools may identify certain URLs that are accessible during routine scans that should not have allowed access.
-
Among the URLs that are typically detected are URLs that can download Liferay's JS (JavaScript) to the equipment being accessed.
- For example, if you inject the parameter o/frontend-js-aui-web/liferay/dependency.js.map into your virtual host, the dependency.js file will be downloaded to your device.
- Can the possibility of downloading this file be considered a vulnerability?
Environment
- Liferay DXP 7.4
- Liferay DXP 7.3
- Liferay DXP 7.2
Resolution
-
From a product standpoint, there are multiple accessible files where you can see part of the code. In fact, any file served to the browser can be downloaded but this should not be considered a vulnerability.
-
Liferay DXP is an open-source product and we can say that this is an expected behavior and we do not consider it a risk.
Additional Information
- For more details on best practices when opening a security ticket, please see: Before Opening a Security Ticket
- If you have any additional questions about this topic, please submit a ticket to the Support team through our Help Center.