Site Search - Liferay Learn

How to allow unauthenticated (guest user) requests for GraphQL

Issue I implemented ReactJS Widget that relies on GraphQL requests for custom object values, with a widget exposing object entries to the public. However, unauthenticated GrapQL requests are disabled by default and...

Tomcat's vulnerability CVE-2023-44487

legacy

Issue Is DXP 7.4 affected by Tomcat's Rapid Reset CVE-2023-44487? Environment Liferay DXP 7.4 Resolution If user is not using Tomcat with DXP, then it is not affected by “Tomcat's Rapid Reset CVE-2023-44487”. If...

Vulnerabilities reported in classes generated by Liferay Service Builder

legacy Troubleshooting

Issue While performing security scans, there are vulnerabilities found in custom classes that are generated by Liferay Service Builder. Environment Liferay DXP 7.4 Resolution Sometimes, these warnings are...

Is there a release date for implementing the Content Security Policy (CSP) at Liferay?

legacy

Issue If CSP is in beta mode, how is Liferay protecting its system from vulnerability? Is there a timescale for when the CSP will be fully deployed in the portal? Once the CSP has been successfully implemented,...

How to change the generated OTP from alphanumeric to numeric in multi-factor authentication?

legacy How To

NOTE: The following resolution requires customization and should only be implemented at the discretion of your team. Liferay Support will not be able to assist with designing or implementing customizations. Issue...

Vulnerability CVE-2024-52046 in Liferay DXP

legacy How To

Issue Is Liferay vulnerable to the vulnerability described in CVE-2024-52046? Environment Liferay DXP 7.3 and above Resolution Liferay uses the affected Apache Mina library (`mina-core`) only in LDAP-related code. If...

Is Liferay Vulnerable to CVE-2023-45960?

legacy

Issue I would like to know if Liferay is vulnerable to CVE-2023-45960? Is Liferay affected by CVE-2023-45960? Environment Quarterly Release 2024.Q1.7 Resolution The NIST listing for CVE-2023-45960 has been withdrawn and...

Enabling real-time antivirus scanning without asynchronous background scans

legacy How To

Issue We would like to enable real-time antivirus scanning for uploaded files but disable asynchronous background scanning of the document library. The issue arises because: Enabling...

Embedding videos using basic web content

legacy Troubleshooting

Issue When we try to embed a video using <iframe> tags, during the creation the video displays, however after publishing the content and editing it again, the video is not displayed anymore and the source is updated...

Liferay Throws java.lang.ClassCastException: class org.apache.xerces.parsers on Login

legacy Troubleshooting

Issue Liferay throws a ClassCastException after upgrading, the upgrade logs show no errors. Liferay throws an error after non-graceful shutdown ERROR [http-nio-8080-exec-8][AutoLoginFilter:247] Current URL...

Is Liferay DXP affected by CVE-2024-38286?

legacy Troubleshooting

Issue Is Liferay DXP affected by CVE-2024-38286? CVE-2024-38286 is an Apache Tomcat vulnerability wherein Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by...

[T003] Open redirect in /c/document_library/find_folder with DNS rebinding vulnerability

legacy Troubleshooting

Issue Medium threat found during the performance testing: [T003] Open redirect in /c/document_library/find_folder with DNS rebinding Environment Liferay Quarterly release Resolution The reported concern has been...

Enabling SSO for our Liferay Console prevents logging in with email and password

legacy

Issue After enabling SSO for our Liferay Console, we are no longer able to log in with email and password. Environment DXP 7.4 Resolution This is expected behavior, as per the Official documentation for SSO: "The first...

HTTP Strict-Transport-Security Header in Liferay

legacy

Issue Is HTTP Strict-Transport-Security Header enabled in Liferay? Environment Liferay DXP 7.4 Resolution Liferay enables HTTP security headers such as 'http.header.secure.x.content.type.options',...

Unable to Cancel Shutdown Event

legacy Troubleshooting

Issue After scheduling a shutdown event, and trying to cancel it, you see an error: "Error:Text verification failed." When trying to cancel a shutdown event, I'm prompted to input a CAPTCHA, but there is...

A simple example and key factors to check when testing custom OAuth 2.0 applications

legacy How To

Issue You have created an OAuth 2.0 application and would like to set up the minimum configuration to be able to test it. This article provides a simple example that could be adapted to your needs....

OpenID Connect Client Secret field must be filled

legacy Troubleshooting

Issue I configured an OpenID Connect Provider Connection. When I try to login using the OpenID Connect Client Name, I get an internal server error. In logs, a java exception is thrown: WARN [http...

Residual risk after limiting the usage of unsafe-eval and unsafe-inline

legacy

Issue Can the derivatives unsafe-eval and unsafe-inline be exploited? If yes, how it is done? What is the residual risk associated with this? Can Content Security Policy (CSP) be resolved by adding a reverse...

Is Liferay vulnerable to CVE-2023-50164?

legacy

Issue After running a scan, we received an alert about a possible vulnerability in Liferay. We want to confirm if we are vulnerable to CVE-2023-50164. Environment All environments. Resolution Liferay is not...

Deprecation of Liferay Sync

legacy

Issue I'd like to inquire about the support for Liferay 7.4 in the Liferay Sync. Currently, the Compatibility Matrix only lists support for Liferay DXP 7.3. Environment Liferay DXP 7.4+ Resolution Liferay Sync got...

Search Results