Liferay Portal and Liferay DXP vulnerabilities

Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP in specified versions do not limit API access before a user has verified their email address. Remote users can access and edit content via the API without email verification.

A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119 and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.

An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.