com.liferay.portal:com.liferay.portal.impl@5.9.0 vulnerabilities
latest version
109.0.0
latest non vulnerable version
first published
8 years ago
latest version published
19 days ago
licenses detected
- [1.0.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the com.liferay.portal:com.liferay.portal.impl package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the How to fix Cross-site Scripting (XSS)? Upgrade | [,7.8.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to insufficient protection on the terms of use page. An attacker can trick a user into accepting the site's terms of use by convincing them to visit a malicious page. How to fix Cross-site Request Forgery (CSRF)? Upgrade | [,5.25.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Observable Discrepancy due to the handling of different responses based on site existence or user permissions. An attacker can discover the existence of sites by enumerating URLs. Note: This is only exploitable if How to fix Observable Discrepancy? Upgrade | [,7.8.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) in How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade | [,47.1.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Open Redirect via the How to fix Open Redirect? Upgrade | [,7.9.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Access Restriction Bypass by not properly checking user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI. How to fix Access Restriction Bypass? Upgrade | [,6.05) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Information Exposure. User's passwords are stored in the database if workflow is enabled for new users. This allows attackers with access to the database to obtain the user's unencrypted password. How to fix Information Exposure? Upgrade | [,5.11.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Information Exposure. It allows remote attackers to enumerate user email addresses via the forgot password functionality. The How to fix Information Exposure? Upgrade | [,5.11.0) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Privilege Escalation. It allows remote authenticated users with permission to update or edit users to take over a company administrator user account by editing the company administrator user. How to fix Privilege Escalation? Upgrade | [,5.16.4) |
com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Arbitrary File Access. The property How to fix Arbitrary File Access? Upgrade | [7.2.0,7.4.0)[0,7.1.3) |