Site Search - Liferay Learn

Vulnerability in Apache Tomcat (CVE-2023-46589)

Issue This security vulnerability (CVE-2023-46589) has been reported, and it is fixed in Tomcat 9.0.83. However, our current Liferay DXP 7.4 update 67 has a 9.0.71 Tomcat version. Environment Liferay DXP 7.4...

Liferay 6.2 EE 173 and CVE-2024-25145

legacy

Issue We have found the following article CVE-2024-25145 Stored XSS with search results if highlighting is disabled, however it does not specify whether Liferay 6.2 EE 173 is affected or not. Environment Liferay 6.2 EE...

Can SAML be used to send an attribute that can be used to assign site roles?

legacy

Issue Currently, SAML is not designed to be utilized to send an attribute that can be used to assign site roles. Environment Quarterly Releases Resolution This is an ongoing task, LPD-6336, for Liferay. Liferay is...

OpenID Connect Error - "Signed JWT rejected" with CAS

legacy Troubleshooting

Issue When configuring authentication using OpenID Connect, login fails and the following error is reported: Unable to validate tokens: Signed JWT rejected: Another algorithm expected, or no matching key(s) found...

/c/ redirects to login page

legacy

Issue When the user tries to access the URL: 'http://localhost:8080/c/', even if the 'c' page doesn't exist, it redirects to the login page instead of a 404 page not found. Environment Liferay DXP [all versions]...

Log messages for Stored XSS vulnerabilities

legacy Troubleshooting

Issue We would like to know whether there are any strings to search for in log files, to check if any of the following vulnerabilities have been exploited in our environment? LSV-1237 / CVE-2023-42628 LSV-1236 /...

Getting 'DuplicateSamlIdpSsoSessionException' in the Debug Logs

legacy Troubleshooting

Issue Users are facing intermittent login issues in the SAML environment; however, the below error is observed frequently in their log files: DEBUG [default task-73687][BaseSamlStrutsAction:61] null...

Security Vulnerability CVE-2023-28708

legacy How To

Issue This security vulnerability (CVE-2023-28708) has been reported, and it is fixed in Tomcat 9.0.72. However, our current Liferay DXP 7.3 SP1 has a 9.0.40 Tomcat version. Environment Liferay DXP 7.3 Resolution...

Error "Invalid site key" when using reCAPTCHA v3

legacy Troubleshooting

Issue When configuring reCAPTCHA v3 and testing it on the "Forgot Password" page, the following error message is reported: "ERROR for site owner: Invalid site key". Environment Liferay DXP 7.2+ Resolution Liferay...

How to enable cookies and the banner, consent panel

legacy How To

Issue How to enable the cookie preference handling as well as the configuration options for both the banner and the consent panel. Environment Liferay DXP 7.4 Resolution This feature was introduced in the Liferay...

SAML Sessions remain Active despite Logout in Liferay

legacy Troubleshooting

Issue We have integrated SAML with our Liferay configuration. We have noticed that after a User logs out, their session remains active in Liferay. Environment Liferay DXP 7.3 Resolution This issue may occur if the...

Requests to Liferay with an invalid HOST request HTTP header returns the default site

legacy Troubleshooting

Note: please note that Liferay has renamed its Liferay Experience Could offerings to Liferay SaaS (formerly LXC) and Liferay PaaS (formerly LXC-SM). Issue Requests to Liferay with an invalid HOST request...

Access-control-allow-origin CORS Header not honoring System setting Configuration

legacy

Issue When configuring CORS headers in System Settings we are seeing that access-control-allow-origin header doesn't always have the configured value. Environment Liferay DXP 7.4 Resolution According to the...

Security Managers, Vul ID: V-222936 STIG

legacy

Issue Vul ID: V-222936 STIG is flagged when Java Security Managers are not enabled. It states that "The Java Security Manager must be enabled." Environment DXP 7.1 Resolution Liferay DXP does not currently support...

Duplicate user errors when setting up a SAML Authentication to replace an existing Token-Based SSO

legacy Troubleshooting

Issue When trying to set up a SAML authentication to replace existing Token-Based SSO, there are errors that populate stating that the user and/or email address is already in use. A user with company 1xxxx and email...

LDAP Related Queries

legacy

Issue If the password is changed in the Active Directory, the user will still be able to log in to DXP? If we delete the user from Active Directory, the user will still be able to log in to DXP? How to import/ export...

Will a curl vulnerability impact Liferay DXP?

legacy

Issue There have been security announcements that are deemed to be a high-risk vulnerability that is caused by curl 8.4.0. Environment DXP 7.3 Resolution Liferay DXP does not use the libcurl library. In conclusion,...

Vulnerability in CKeditor 4.18.0

legacy Troubleshooting

Issue In Liferay, a vulnerable version of CKEditor 4.18.0 is being used. The vulnerability CVE-2023-28439 is present in the CKEditor versions less than 4.21.0. Environment Liferay DXP 7.0+ Resolution The observed...

Nested Azure AD Groups are not assigned to Liferay groups

legacy Troubleshooting

Issue You want to assign Liferay user groups via dynamic Azure AD groups when logging in with SAML. For this, certain rules of Azure AD groups are in place based on your needs. There might be an issue where nested...

Differentiate multiple Identity Provider when click on the Sign-in button

legacy

Issue How the user can login to specific IDP when multiple IDPs are configured on the portal? Environment Liferay DXP 7.0 Liferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution While using...

Is SELinux compatible with Liferay DXP 7.4?

legacy

Issue Is SELinux configuration compatible with Liferay DXP 7.4? Environment Liferay DXP 7.4 Running on one of the supported Operating Systems Resolution It is possible to set up SELinux to work with Liferay DXP 7.4 It is up to...

Insecure Cross Document Messaging

legacy Troubleshooting

Issue Cross Document Messaging (also known as Web Messaging) introduced the postMessage() method, with which plaintext messages can be sent cross-origin. It consists of two parameters: “message”, and...

CSP headers are not working on DXP-7.4

legacy Troubleshooting

Issue Trying to attempt to work with the CSP feature, which is present in update 90 under feature flags, but users are still experiencing issues where they are unable to edit the page and it is continuously...

How to implement a token system instead of using credentials to access remote services

legacy How To

Issue Trying to write a custom remote service using Liferay (ServiceImpl file), so which method may be used to authenticate using a token rather than credentials? Environment Liferay DXP 7.4 Resolution Liferay has...

Is There A Way To Verify ClamAV Integration With Liferay?

legacy Troubleshooting

Issue We followed the instructions below to enable document virus scanning, but we do not see any way to confirm the ClamAV integration was successful or that file scans are occurring when new files are uploaded to...

ORA-12899 because OpenID access token is too large

legacy

Issue We store several things in our OpenID access token and when a user tries to log in, it fails because the token size exceeds the 3000-character limit specified in the ACCESSTOKEN column of the...

AntiSamy sanitizer cleans some of the HTML tags and styles, how can we solve that?

legacy Troubleshooting

Issue We turned on AntiSamy but it removes certain HTML code and CSS styles from our Web Content articles. Environment DXP 7.0+ Resolution Usage of HTML and CSS in Web Content article HTML fields Web content articles...

How is AntiSamy configured?

legacy

Issue We configured AntiSamy to santize Web Content articles. We would like to understand how AntiSamy works and what parts are expected to be removed in Web Content articles. Environment DXP 7.0+ Resolution In the...

Can Liferay Support SP and IDP initiated SAML Simultaneously?

legacy

Issue Our team is the design phase for authentication and we want to know if Liferay supports IDP and SP initiated SAML logins at the same time? Environment DXP 7.4 Resolution No, a single instance should not be both...

Force Authentication in SAML requiring reauthentication in SP

legacy How To

Issue With SAML and Force Authentication enabled, I am required to reauthenticate requests from the SP Environment DXP 7.3, 7.4 Resolution This behavior is intended, but to avoid manual reauthentication in this...

Captcha authentication via Headless API

legacy

Issue We have developed a Liferay fragment to collect user input via a custom-designed HTML form. This fragment interacts with custom Liferay objects through a Headless API using JS We have created a new role with the...

Is there a way identify When was the user Deactivated and by Whom?

legacy How To

Issue Is there a possible way to find out when was the exact date the Liferay user was deactivated and by whom? Environment Liferay DXP 7.3 Liferay DXP 7.4 Resolution Please run the attached Groovy script to get a...

How can I access OpenIdConnectProvider classes in 7.4 U34+?

legacy How To

Issue The Liferay classes com.liferay.portal.security.sso.openid.connect.OpenIdConnectProvider; and com.liferay.portal.security.sso.openid.connect.OpenIdConnectProviderRegistry; were removed in U34+...

How do we Toggle Requirement for Strangers to Verify their Email Address

legacy How To

Issue How do we toggle the requirement for strangers to verify their email address Environment DXP 7.4 Resolution This setting can be toggled by going to: Instance Settings > User Authentication. From here, you can...

Checking for vulnerability to CVE-2022-42889

legacy Troubleshooting

Issue Is our Liferay instance vulnerable to CVE-2022-42889? Environment DXP 7.4, DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution Look for commons-text in ${liferay.home}/license/versions.html, if you do not find it, you...

How to test for vulnerabilitity to CVE-2020-7961

legacy How To

Issue We would like to determine if we are vulnerable to CVE-2020-7961. Environment DXP 7.3, DXP 7.2, DXP 7.1, DXP 7.0 Resolution The steps to test for vulnerability to CVE-2020-7961 are as follows: 1. Start your...

CVE-2020-28885 and CVE-2020-28884

legacy

Issue We would like to know about Liferay's vulnerability to CVE-2020-28885 and CVE-2020-28884. The CVE's claim that it is a vulnerability for an Administrator User to be able to inject commands through the Gogo Shell...

Is Liferay vulnerable to CVE-2023-40371 and CVE 2023-38408?

legacy

Issue Is Liferay vulnerable to any of these vulnerabilities? Environment DXP 6.2+ Resolution No, Liferay is not vulnerable to any of these two. Neither CVE relates to any Liferay features, so they do not...

What should be done when answers to the security questions are forgotten?

legacy How To

Issue My users keep forgetting their answers to the security questions is there a way to disable this? Also is there an alternative to the forgot password option? Environment DXP 7.4 Resolution Liferay already sends a...

0Auth2.0 issues new token every time even before token's expiration time

legacy

Issue The access_token expiration default is set to 10 minutes. When invoking the /oauth2/token before the previous token expires, a brand new token is issued instead of the original token. Environment DXP 7.4...

Search Results