Homepage

com.liferay.portal:com.liferay.portal.kernel@67.0.1 vulnerabilities

  • latest version

    166.0.0

  • first published

    9 years ago

  • latest version published

    2 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the com.liferay.portal:com.liferay.portal.kernel package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the referer and FORWARD_URL parameters. An attacker can execute arbitrary JavaScript in the context of a user's browser by injecting malicious payloads using encoded characters and a null-byte (%00) in these parameters.

    How to fix Cross-site Scripting (XSS)?

    Upgrade com.liferay.portal:com.liferay.portal.kernel to version 155.0.0 or higher.

    [,155.0.0)
    • M
    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the PortalUtil.escapeRedirect function. An authenticated attacker can execute arbitrary JavaScript in the context of a user's browser by injecting malicious input into the affected process.

    How to fix Cross-site Scripting (XSS)?

    Upgrade com.liferay.portal:com.liferay.portal.kernel to version 157.0.0 or higher.

    [,157.0.0)
    • M
    Timing Attack

    Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests.

    How to fix Timing Attack?

    Upgrade com.liferay.portal:com.liferay.portal.kernel to version 157.0.0 or higher.

    [,157.0.0)
    • M
    Information Exposure

    Affected versions of this package are vulnerable to Information Exposure via the calendar implementation. An attacker can obtain access to other users' calendars and their names by sending crafted requests, which may enable further targeted attacks such as phishing.

    How to fix Information Exposure?

    Upgrade com.liferay.portal:com.liferay.portal.kernel to version 160.0.0 or higher.

    [,160.0.0)
    • M
    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the message boards feature available through the web interface. An attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious scripts into messages.

    How to fix Cross-site Scripting (XSS)?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • L
    Access Control Bypass

    Affected versions of this package are vulnerable to Access Control Bypass due to unauthorized access to object definition via search. The Object module does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

    How to fix Access Control Bypass?

    Upgrade com.liferay.portal:com.liferay.portal.kernel to version 94.0.0 or higher.

    [,94.0.0)
    Go back to all versions of this package