Liferay Digital Experience Platform (DXP) 7.0 Fix Pack 59

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:*

part: a version: 7.0 update: fix_pack_59

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDigital Experience Platform (ff76fa00-2b41-514b-9b5f-2ad7f4e73e64)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-42628 vulnerable 2026-06-08 06:11:08.728339 Details available
CRITICAL (9)
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Published: 2023-10-17T11:52:45.867Z
Updated: 2024-08-02T19:23:40.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-42132 vulnerable 2026-06-08 05:49:29.466618 Details available
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Published: 2022-11-15T00:00:00.000Z
Updated: 2026-07-09T00:22:05.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-28978 vulnerable 2026-06-08 05:42:46.241666 Details available
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Published: 2022-09-21T23:38:59.000Z
Updated: 2026-07-09T00:18:43.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26596 vulnerable 2026-06-08 05:41:52.563631 Details available
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Published: 2022-04-25T15:41:28.000Z
Updated: 2026-07-09T00:18:02.597Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38266 vulnerable 2026-06-08 05:32:55.799616 Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38263 vulnerable 2026-06-08 05:32:55.746849 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33334 vulnerable 2026-06-08 05:32:11.295037 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33333 vulnerable 2026-06-08 05:32:11.289206 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33331 vulnerable 2026-06-08 05:32:11.281181 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33328 vulnerable 2026-06-08 05:32:11.274729 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33326 vulnerable 2026-06-08 05:32:11.255008 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33325 vulnerable 2026-06-08 05:32:11.221647 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33322 vulnerable 2026-06-08 05:32:11.189353 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33320 vulnerable 2026-06-08 05:32:11.150756 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29049 vulnerable 2026-06-08 05:31:25.569847 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29044 vulnerable 2026-06-08 05:31:25.524870 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29043 vulnerable 2026-06-08 05:31:25.504288 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29040 vulnerable 2026-06-08 05:31:25.455047 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15842 vulnerable 2026-06-08 05:19:27.021040 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15841 vulnerable 2026-06-08 05:19:26.984735 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.