CVE Intelligence

Vulnerabilidades de Liferay

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Liferay: 29 registro(s), com severidade, exploração e correções.

Liferay Portal 28Digital Experience Platform 28DXP 28

Somente exploradas (KEV) →

CVE-2025-62241 Média · 4.3 CWE-639 13/10/2025
Authorization Bypass Through User-Controlled Key (IDOR) em Liferay Digital Experience Platform
Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
CVE-2025-62243 Média · 5.4 CWE-863 13/10/2025
Incorrect Authorization em Liferay Digital Experience Platform
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter. Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.
CVE-2025-62244 Média · 4.3 CWE-639 13/10/2025
Authorization Bypass Through User-Controlled Key (IDOR) em Liferay Digital Experience Platform
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.
CVE-2020-7961 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-502 20/03/2020
Liferay Portal Deserialization of Untrusted Data Vulnerability
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).