GitHub Advisoryadvisory · Maven

GHSA-869h-qhfx-w939 Liferay Portal has an XXE vulnerability in Java2WsddTask._format

HIGH Published 2024-02-20 Modified 2024-12-11 Official page ↗
Aliases
CVE-2024-25606
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.util.java, com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2024-12-11

Affected packages

• Maven com.liferay.portal:com.liferay.util.java: < 14.0.0 → fixed in 14.0.0 • Maven com.liferay.portal:release.portal.bom: < 7.4.3.8 → fixed in 7.4.3.8 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.u12 → fixed in 7.3.10.u12 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u4 → fixed in 7.4.13.u4 • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp20 → fixed in 7.2.10.fp20

Description

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

Related

Alias · CVE (1)

  • CVE-2024-25606 XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References