Liferay Portal, Liferay DXP vulnerabilities

An improper access control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0-2024.Q2.8, 2024.Q1.1-2024.Q1.12, 7.4 GA through update 92) allows guest users to obtain object entries information via the API Builder.

The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.

XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.