Site Search - Liferay Learn

Tomcat Vulnerability Impact (CVE-2023-28708)

Please be aware that the page you are viewing has been machine translated from Japanese into English and may contain some translation errors. If you observe any issues with the translation, please contact us. Issue...

Service Organization Control (SOC) -1 Type 2 report

legacy

Issue Service Organization Control (SOC) -1 Type 2 report for auditing purposes. Environment Liferay DXP Resolution The SOC-1 report focuses on financial controls and their evaluation and this reporting is not...

Liferay's OpenID Connect implementation does not account for language variations for ui_locales

legacy

Issue Liferay's OpenID Connect implementation does not account for language variations for ui_locales. For example, Selecting English (United States) on Liferay sets ui_locales to en. Selecting Chinese (either Traditional...

A blank SAML redirect screen is seen even with redirect message disabled

legacy

Issue A blank intermediary page (showing "Please select your identity provider" title and /portal/c/portal/login?redirect=%2Fportal%2F&refererPlid=[sanitized]&p_l_id=[sanitized] URL) is being seen even with the hotfix...

LDAP import PermissionChecker not initialized

legacy Troubleshooting

Issue When importing users by Groups and enabling ‘Creating Roles on Import’, the roles and groups will be created/imported, but the users are not imported. Error reads PermissionChecker not initialized...

Security Issue: CVE-2024-28752 - Apache CXF

legacy

Issue Security vulnerability CVE-2024-28752 details a SSRF vulnerability with the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3, and 3.5.8, which would allow an attacker to perform SSRF style attacks...

Unable to get OpenID Connect's link to work after upgrading to a Quarterly Release

legacy Troubleshooting

Issue After upgrading to Quarterly Release 2023.Q3.4 from DXP 7.3, we've found that OpenID Connect is no longer working. The button is no longer populating within the UI even after enabling it using this article:...

Multi-Factor Authentication via SMS

legacy

Issue We want to set up MFA via SMS without using any external Apps. Is this possible with Liferay out-of-the-box? Environment Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Resolution MFA by SMS is not...

[T003] Open redirect in /c/document_library/find_folder with DNS rebinding vulnerability

legacy Troubleshooting

Issue Medium threat found during the performance testing: [T003] Open redirect in /c/document_library/find_folder with DNS rebinding Environment Liferay Quarterly release Resolution The reported concern has been...

Embedding videos using basic web content

legacy Troubleshooting

Issue When we try to embed a video using <iframe> tags, during the creation the video displays, however after publishing the content and editing it again, the video is not displayed anymore and the source is updated...

Is Liferay DXP affected by CVE-2024-38286?

legacy Troubleshooting

Issue Is Liferay DXP affected by CVE-2024-38286? CVE-2024-38286 is an Apache Tomcat vulnerability wherein Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by...

SCIM API is not working as expected to link existing users to SCIM Client

legacy

Issue I'm unable to use the PUT API to update users as linked to the SCIM Client. I'm not able to add new users and then update them using the PUT API linking them to the SCIM client. Environment 2024.Q1+ Resolution...

Password for LDAP and Liferay users should not expire

legacy Troubleshooting

Issue After integrating Liferay with the LDAP server for users, the passwords for the users are expiring after some time and are required to be reset again. Is there any way for the passwords to never...

Enabling SSO for our Liferay Console prevents logging in with email and password

legacy

Issue After enabling SSO for our Liferay Console, we are no longer able to log in with email and password. Environment DXP 7.4 Resolution This is expected behavior, as per the Official documentation for SSO: "The first...

Resolving 401 Errors When Using Authorization Bearer Tokens in RestBuilder APIs

legacy Troubleshooting

Issue When making calls to a REST API service created with RestBuilder that includes the Authorization Bearer token header, the responses often return a 401 Unauthorized status. However, when the same service is...

High CPU and memory use with stacktraces associated to password encryption

legacy Troubleshooting

Issue The environment starts using a large amount of CPU and also memory. Reviewing thread dumps taking during that time, there are many threads associated to PBKDF2PasswordEncryptor.encrypt, such as:...

Enabling real-time antivirus scanning without asynchronous background scans

legacy How To

Issue We would like to enable real-time antivirus scanning for uploaded files but disable asynchronous background scanning of the document library. The issue arises because: Enabling...

Enabling both Liferay's default login and SAML login so that users can use either option

legacy How To

Issue I would like to configure and enable SAML login while also having Liferay's default login available to users so that they can have two options for logging in. Environment DXP 7.4+ Quarterly Release Resolution...

Is Session Prediction Possible in Liferay

legacy

Issue Is it possible an attacker could predict the JSESSIONID and gain unauthorized access, referencing an example from a 'Session Prediction' article? Explanation of Issue Using the "Catalog" Page in Postman: If a...

Is Liferay Vulnerable to CVE-2023-45960?

legacy

Issue I would like to know if Liferay is vulnerable to CVE-2023-45960? Is Liferay affected by CVE-2023-45960? Environment Quarterly Release 2024.Q1.7 Resolution The NIST listing for CVE-2023-45960 has been withdrawn and...

Search Results