Liferay Digital Experience Platform (DXP) 7.0 Fix Pack 43

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:*

part: a version: 7.0 update: fix_pack_43

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDigital Experience Platform (ff76fa00-2b41-514b-9b5f-2ad7f4e73e64)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-42628 vulnerable 2026-06-08 06:11:08.717618 Details available
CRITICAL (9)
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Published: 2023-10-17T11:52:45.867Z
Updated: 2024-08-02T19:23:40.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-42132 vulnerable 2026-06-08 05:49:29.452764 Details available
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Published: 2022-11-15T00:00:00.000Z
Updated: 2026-07-09T00:22:05.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-28978 vulnerable 2026-06-08 05:42:46.232853 Details available
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Published: 2022-09-21T23:38:59.000Z
Updated: 2026-07-09T00:18:43.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26596 vulnerable 2026-06-08 05:41:52.553637 Details available
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Published: 2022-04-25T15:41:28.000Z
Updated: 2026-07-09T00:18:02.597Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38266 vulnerable 2026-06-08 05:32:55.799137 Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38263 vulnerable 2026-06-08 05:32:55.737150 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33334 vulnerable 2026-06-08 05:32:11.294694 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33333 vulnerable 2026-06-08 05:32:11.288698 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33331 vulnerable 2026-06-08 05:32:11.280598 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33328 vulnerable 2026-06-08 05:32:11.274146 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33326 vulnerable 2026-06-08 05:32:11.254603 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33325 vulnerable 2026-06-08 05:32:11.221306 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33322 vulnerable 2026-06-08 05:32:11.188691 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33320 vulnerable 2026-06-08 05:32:11.142191 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29049 vulnerable 2026-06-08 05:31:25.569401 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29044 vulnerable 2026-06-08 05:31:25.524383 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29043 vulnerable 2026-06-08 05:31:25.503694 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29040 vulnerable 2026-06-08 05:31:25.445824 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15842 vulnerable 2026-06-08 05:19:27.013535 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15841 vulnerable 2026-06-08 05:19:26.976079 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.