Liferay Digital Experience Platform (DXP) 7.0 Fix Pack 40

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:*

part: a version: 7.0 update: fix_pack_40

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDigital Experience Platform (ff76fa00-2b41-514b-9b5f-2ad7f4e73e64)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-42628 vulnerable 2026-06-08 06:11:08.715870 Details available
CRITICAL (9)
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Published: 2023-10-17T11:52:45.867Z
Updated: 2024-08-02T19:23:40.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-42132 vulnerable 2026-06-08 05:49:29.451103 Details available
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Published: 2022-11-15T00:00:00.000Z
Updated: 2026-07-09T00:22:05.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-28978 vulnerable 2026-06-08 05:42:46.231356 Details available
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Published: 2022-09-21T23:38:59.000Z
Updated: 2026-07-09T00:18:43.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26596 vulnerable 2026-06-08 05:41:52.552079 Details available
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Published: 2022-04-25T15:41:28.000Z
Updated: 2026-07-09T00:18:02.597Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38266 vulnerable 2026-06-08 05:32:55.798986 Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38263 vulnerable 2026-06-08 05:32:55.735510 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33334 vulnerable 2026-06-08 05:32:11.294568 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33333 vulnerable 2026-06-08 05:32:11.288650 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33331 vulnerable 2026-06-08 05:32:11.280547 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33328 vulnerable 2026-06-08 05:32:11.274098 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33326 vulnerable 2026-06-08 05:32:11.254461 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33325 vulnerable 2026-06-08 05:32:11.221256 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33322 vulnerable 2026-06-08 05:32:11.188564 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33320 vulnerable 2026-06-08 05:32:11.140673 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29049 vulnerable 2026-06-08 05:31:25.569273 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29044 vulnerable 2026-06-08 05:31:25.524161 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29043 vulnerable 2026-06-08 05:31:25.503457 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29040 vulnerable 2026-06-08 05:31:25.444122 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15842 vulnerable 2026-06-08 05:19:27.013485 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15841 vulnerable 2026-06-08 05:19:26.974321 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.