Liferay Portal/DXP vulnerabilities

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP in the listed versions has a security vulnerability allowing improper access through the expandoTableLocalService. This may allow unauthorized access to data or functions.

Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.

Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34 and older unsupported versions, store password reset tokens in plain text. This allows attackers with database access to obtain the token, reset a user's password, and take over the account.

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.