Liferay Digital Experience Platform (DXP) 7.0 Fix Pack 69

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:*

part: a version: 7.0 update: fix_pack_69

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDigital Experience Platform (ff76fa00-2b41-514b-9b5f-2ad7f4e73e64)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-42628 vulnerable 2026-06-08 06:11:08.736270 Details available
CRITICAL (9)
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
Published: 2023-10-17T11:52:45.867Z
Updated: 2024-08-02T19:23:40.284Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-42132 vulnerable 2026-06-08 05:49:29.473872 Details available
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Published: 2022-11-15T00:00:00.000Z
Updated: 2026-07-09T00:22:05.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-28978 vulnerable 2026-06-08 05:42:46.245958 Details available
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Published: 2022-09-21T23:38:59.000Z
Updated: 2026-07-09T00:18:43.181Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-26596 vulnerable 2026-06-08 05:41:52.569280 Details available
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Published: 2022-04-25T15:41:28.000Z
Updated: 2026-07-09T00:18:02.597Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38266 vulnerable 2026-06-08 05:32:55.799978 Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-38263 vulnerable 2026-06-08 05:32:55.753641 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33334 vulnerable 2026-06-08 05:32:11.295200 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33333 vulnerable 2026-06-08 05:32:11.289338 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33331 vulnerable 2026-06-08 05:32:11.281402 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33328 vulnerable 2026-06-08 05:32:11.274895 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33326 vulnerable 2026-06-08 05:32:11.255224 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33325 vulnerable 2026-06-08 05:32:11.221862 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33322 vulnerable 2026-06-08 05:32:11.189693 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33320 vulnerable 2026-06-08 05:32:11.154789 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29049 vulnerable 2026-06-08 05:31:25.570077 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29044 vulnerable 2026-06-08 05:31:25.525322 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29043 vulnerable 2026-06-08 05:31:25.504684 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-29040 vulnerable 2026-06-08 05:31:25.459504 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15842 vulnerable 2026-06-08 05:19:27.021518 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-15841 vulnerable 2026-06-08 05:19:26.989361 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.