XXE vulnerability in OpenID authentication

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 6.1 EE GA3 (6.1.30), 6.2 EE GA1 (6.2.10)
• Fix Version/s: 6.1.X EE, 6.2.X EE
• Component/s: Application Security > OpenID, Security Vulnerability
• Labels:
  • 61-ee-ga3-sp5
  • 62-ee-sp12
  • cumulative-security-update-2
  • liferay-fixpack-portal-43-6130
  • liferay-fixpack-portal-57-6210
  • lsv
  • lsv-123
  • sev-1

Portal use old version of openid4java.jar that is vulnerable to XXE attack. This flaw allows an attacker to read file system, connect to internal systems (SSRF) and perform DoS on portal.

See also https://web.liferay.com/group/customer/products/portal/security-vulnerability/lsv-123