Site Search - Liferay Learn

Does having a script in a button fragment qualify as a potential XSS vulnerability?

Issue We can put a Javascript code in the Button fragment's URL field, so it can be executed when we click on the button, like javascript:alert(document.cookie) Can that be a vulnerability to Cross Site...

Does having a script in a fragment qualify as a potential XSS vulnerability?

legacy

Issue We can put Javascript code in a fragment's HTML section where the code can be executed, when the fragment is opened, like <img src=x onerror="alert(document.cookie)"> Can that be a vulnerability to...

After configuring a CDN, Liferay does not load images and throws error in browser console

legacy Troubleshooting

Issue We have configured a CDN with our Liferay environment. The portal is unable to load Liferay JS/CSS and images and we see errors in the browser console: Access to XMLHttpRequest at 'https...(CDN)' from origin...

Liferay accepts only fully signed SAML responses. Can this requirement be turned off?

legacy

Issue From a security standpoint, it's a best practice to sign the Response. However, we can switch off this requirement in our other apps. I can understand that Liferay by default requires the complete signature of...

Is Liferay's SAML Service Provider Logout URL required in the Identity Provider?

legacy Troubleshooting

Issue Azure's SAML Identity Provider (IdP) marks the Service Provider's (SP) Logout URL as "optional" However, when I remove Liferay's Logout URL from Azure's SAML configurations, Liferay users are not signed out...

XSS and Web Content editing

legacy Troubleshooting

Issue Web Content Editing If a script is added to the content field and published, the script is executed when the article is displayed. Accessing the page triggers an alert each time. Allowing such content could...

Does CVE-2022-47966 affect Liferay?

legacy

Issue Our security scan has shown CVE-2022-47966 as an active critical vulnerability. Is Liferay affected? Environment DXP 7.2 Resolution The out-of-the-box Liferay product is not affected by this vulnerability. So,...

SQL injection Sleepy user agent attack

legacy

Issue Liferay does not restrict a URL that has a 'sleepy user agent' query appended to it like: https://domain/page?1%2b(select*from(select(sleep(x)))a)%2b=1 Environment Liferay DXP 7.4 Resolution Sleepy user agent...

SAML Download Certificate button is broken, with Redirect URL errors seen

legacy Troubleshooting

Issue The Download Certificate button doesn't work in the SAML Admin. When I click on the Download Certificate button, nothing happens. Redirect URL errors are seen in Liferay logs, such as:...

SAML Admin - "Metadata XML is null" error

legacy Troubleshooting

Issue When attempting to create a new Identity Provider under SAML Admin, having entered the required information, when ‘Save’ is clicked the UI displays: "Error: Please enter a valid identity provider entity ID."...

Disabling jQuery in Control Panel

legacy How To

Issue I've found vulnerabilities in our current jQuery version. Since I can't find jQuery used anywhere, I would like to disable it. Environment Liferay DXP 7.2 Resolution Go to Control Panel --> System Settings -->...

Blank screen is seen after password reset

legacy Troubleshooting

Issue A blank screen (with url http://localhost:8080/c) is seen after user password is reset. The expected behavior after password reset is for users to A) be successfully redirected to Liferay home page and B) remain...

Users see the message "Redirecting to your identity provider" before redirecting to OKTA login screen

legacy Troubleshooting

Issue The guest user observed the message "Redirecting to your identity provider" showed up before the OKTA user login screen showed up. The behavior just happened after upgrading the environment to 7.4 Update 56. We don't...

Vulnerability：About CVE-2022-45143

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

Unable to bind to the LDAP server javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]

legacy Troubleshooting

Issue Unable to connect to Open LDAP in DXP due to the following UI error Environment Liferay DXP 7.4 Resolution These errors typically occur when Liferay is unable to communicate with LDAP or when mapping mistakes...

How to update moment.js library

legacy Troubleshooting

Issue For security reasons we need to update the moment.js library from version 2.24.0 to version 2.29.4 How do I update the moment.js library in Liferay DXP? Security vulnerabilities in moment.js 2.24.0:...

How to set SameSite cookie attribute to Strict within Tomcat

How To

Issue How can I adjust the JSESSIONID cookie's SameSite attribute from None to Strict? Environment Liferay DXP 7.1 - 7.4 Resolution The JSessionID cookie's attributes are set by your application server or web...

Errors Suggesting a Search Bot Attack

legacy Troubleshooting

Issue We are seeing many abnormal errors in our Liferay catalina logs all of sudden. We have tried restarting, but the errors continue. What could these mean? ERROR [ajp-nio-0.0.0.0-8009-exec-19][MVCPortlet:557]...

Existing users password encryption algorithm is not updated on password reset

legacy Troubleshooting

Issue The password encryption algorithm of existing users is not being updated after doing a password reset. Environment DXP 7.4 Resolution To resolve this behavior, open a help center ticket to request a hotfix...

Is there a limit to the number of IdPs registered?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us....

Search in Control Panel > Audit makes long URL

legacy

Issue A search in Control Panel > Security > Audit always sends empty search parameters in the GET URL. As a result, URLs are very long and can be blocked by firewall-infrastructure. Steps to reproduce: Navigate to...

Detected vulnerabilities related to Jettison

legacy Troubleshooting

Issue A security scan has picked up the following vulnerabilities related to jettison-1.x.x jar: CVE-2022-40150 & CVE-2022-40149. This jar is found in marketplace\Liferay Foundation - Liferay Portal Remote -...

Behavior when a session expires while posting on the bulletin board

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

How to protect against CVE-2022-41853 vulnerability

legacy Troubleshooting

Issue How can I mitigate vulnerability CVE-2022-41853 regarding Liferay DXP? Environment Liferay Portal 6.2 EE Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Resolution CVE-2022-41853 : This...

Liferay Security Scanning

legacy

Issue What procedures does Liferay follow to perform security scanning? Environment Liferay DXP Resolution Liferay uses DAST and SAST tools for scanning. Pen test and manual code reviews are performed as well....

Link doesn't work in Knowledge base when a non-standard protocol is chosen.

legacy Troubleshooting

Issue When adding the notes:// protocol to a link in Knowledge Base, AntiSamy removes it and displays it as text. Environment Liferay DXP 7.2, 7.3 Resolution By default, everything is sanitized by AntiSamy, with 3...

Are Unique Email Addresses Required for Authentication

legacy

Issue Our company has a few external clients whose users have unique screen names, but all share one email address. This is causing various conflicts such as two users being unable to sign in simultaneously. The error...

How to Login after Blacklisting the Sign-In Portlet

legacy Troubleshooting

Issue We Blacklisted the Sign-In Portlet with a third-party authentication application and the admin logins were not synchronized in the process and so now we can no longer access our environment. How can we restore...

Local Liferay Admin Users unable to authenticate when LDAP is Configured on Virtual Instance

legacy How To

Issue When a main Liferay instance and a second virtual instance are both connected to the same LDAP server, local Liferay admin users are unable to log in when the “Required” box is checked. In the case where the LDAP...

Resource and Global scopes tabs are not listing under oAuth2 administration scopes

legacy How To

Issue I not see the Resource and Global Sub-tabs under the Scopes tab on Oauth2 clients (in Control Panel/ OAuth2 Administration) Environment 7.3+ Resolution After https://issues.liferay.com/browse/LPS-105158 the scope...

LDAP Import Enabled under SAML settings

legacy

Issue What is the actual functionality of LDAP Import Enabledunder SAML settings Environment Liferay DXP 7.2, 7.3, 7.4 SAML Resolution Checking LDAP Import Enabled under SAML settings affects 3 functions:...

Authentication flow in Liferay when LDAP is enabled

legacy

Issue Liferay is configured to use LDAP When Liferay Authentication will happen? When LDAP Authentication will happen? Environment Liferay DXP 7.0 -7.4 Resolution LDAP authentication always happens before...

Need to hide Liferay Auth token as it is visible in Page source

legacy

Issue When using the burp suite tool to intercept traffic, the Liferay Auth token is visible in the Page Source, which could make the environment vulnerable in the user's view. Environment Liferay DXP 7.0+ Resolution...

When logging in with an OpenID Provider, the portal shows "Internal Server Error"

legacy Troubleshooting

Issue When configuring an OpenID Provider and trying to log in with an user, the callback to the portal shows an error message similar to the one below: Internal Server Error An error occurred while...

Is Liferay creating cookies site base?

legacy

Issue Is Liferay creating a cookies site base? If so, where exactly on the Liferay server would all the cookies be physically kept? Environment Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4...

Users who are not registered with Liferay application are able to log in

legacy Troubleshooting

Issue Users who are not registered with the Liferay application are able to log in even though they have no connections. Environment Liferay DXP 7.0 to 7.4 Resolution Users log into Liferay DXP by using...

Lodash Security Vulnerability

legacy Troubleshooting

Issue In Liferay, a vulnerable version of Lodash 4.17.14 is being used. Environment Liferay DXP 7.0 Resolution The observed behavior is a known issue LPE-17236 and has already been fixed in the latest fix...

SSO at site level

legacy

Issue Is there any OOTB option to configure SAML for two sites on the same instance? Whether creating a new instance for a site would help to configure SAML? Environment Liferay DXP 7.2 Liferay DXP 7.3...

Does CVE-2022-34305 affect Liferay?

legacy

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

Portal prints error stacktrace on the browser, disclosing technical information

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue When navigating some incorrectly crafted URLs...

Search Results