| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-1fqz-psdf-g7dm |
| vulnerability_id |
VCID-1fqz-psdf-g7dm |
| summary |
Liferay Portal and Liferay DXP User Enumeration Vulnerability
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 24 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 25 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 26 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 27 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 28 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 29 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 30 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 31 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 32 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 33 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 34 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 35 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 36 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 37 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 38 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 39 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 40 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 41 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 42 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 43 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 44 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 45 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 46 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 47 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 48 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 49 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 50 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 51 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 52 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 53 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 54 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 55 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28 |
|
|
| aliases |
CVE-2024-26268, GHSA-qm43-g2xj-hvg5
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1fqz-psdf-g7dm |
|
| 1 |
| url |
VCID-1jgz-k7zp-uydp |
| vulnerability_id |
VCID-1jgz-k7zp-uydp |
| summary |
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2024-38002, GHSA-3mfq-fp2f-vwqh
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1jgz-k7zp-uydp |
|
| 2 |
| url |
VCID-266t-4gfq-duh4 |
| vulnerability_id |
VCID-266t-4gfq-duh4 |
| summary |
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2024-25150, GHSA-4585-28v2-8h46
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-266t-4gfq-duh4 |
|
| 3 |
| url |
VCID-27a1-teqk-cbe2 |
| vulnerability_id |
VCID-27a1-teqk-cbe2 |
| summary |
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43776, GHSA-rcc7-jx7p-hrv4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-27a1-teqk-cbe2 |
|
| 4 |
| url |
VCID-292m-hgvs-93ey |
| vulnerability_id |
VCID-292m-hgvs-93ey |
| summary |
Liferay Portal Vulnerable to DoS via Crafted Headless API Request
Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 23 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 24 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 25 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 26 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 27 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 28 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 29 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 30 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 31 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 32 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 33 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 34 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 35 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 36 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 37 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 38 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 39 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 40 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 41 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 42 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 43 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 44 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 45 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
|
|
| aliases |
CVE-2025-62260, GHSA-vgqx-447m-wvcj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-292m-hgvs-93ey |
|
| 5 |
| url |
VCID-298n-mh47-3ygq |
| vulnerability_id |
VCID-298n-mh47-3ygq |
| summary |
Liferay Portal has an XXE vulnerability in Java2WsddTask._format
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 9 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 10 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 11 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 12 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 13 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 14 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 15 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 21 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 22 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 23 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 24 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 25 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 26 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 27 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 42 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 43 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 44 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 45 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 46 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 47 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 48 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 49 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 50 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 51 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 52 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 53 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 54 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 55 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 56 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 57 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 58 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 59 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 60 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 61 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 62 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 63 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 64 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 65 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 66 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8 |
|
|
| aliases |
CVE-2024-25606, GHSA-869h-qhfx-w939
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-298n-mh47-3ygq |
|
| 6 |
| url |
VCID-2bcr-bxek-skfq |
| vulnerability_id |
VCID-2bcr-bxek-skfq |
| summary |
Liferay Portal vulnerable to password enumeration
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 3 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 4 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 5 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 6 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 7 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 8 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 9 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 10 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 11 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 12 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 13 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 14 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 15 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 16 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 17 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 18 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 19 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 20 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
|
|
| aliases |
CVE-2025-62257, GHSA-8hw3-ghwv-crfh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2bcr-bxek-skfq |
|
| 7 |
| url |
VCID-2dra-x6f5-xybz |
| vulnerability_id |
VCID-2dra-x6f5-xybz |
| summary |
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43760, GHSA-fvqv-593q-qp8r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2dra-x6f5-xybz |
|
| 8 |
| url |
VCID-2fn6-apud-qbh4 |
| vulnerability_id |
VCID-2fn6-apud-qbh4 |
| summary |
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 53 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 54 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 55 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 56 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 57 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 58 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 59 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 60 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 61 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 62 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 63 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 64 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 65 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 68 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 69 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 70 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 71 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
|
|
| aliases |
CVE-2022-41414, GHSA-9427-7f65-88c8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2fn6-apud-qbh4 |
|
| 9 |
| url |
VCID-2mtb-mdha-qufv |
| vulnerability_id |
VCID-2mtb-mdha-qufv |
| summary |
Liferay Portal Vulnerable to Cross-Site Request Forgery
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 3 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 4 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 5 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 6 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 7 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 8 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 9 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 10 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 11 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 12 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 13 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 14 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 15 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 16 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 17 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 18 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 19 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 20 |
| vulnerability |
VCID-u1pr-9cpx-q3hg |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
|
|
| aliases |
CVE-2025-43748, GHSA-p9gc-59hf-x48p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2mtb-mdha-qufv |
|
| 10 |
| url |
VCID-37ph-hjq9-bufq |
| vulnerability_id |
VCID-37ph-hjq9-bufq |
| summary |
Inefficient Regular Expression Complexity in Liferay Portal
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2022-42124, GHSA-vjj4-qwcm-552h
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-37ph-hjq9-bufq |
|
| 11 |
| url |
VCID-38vz-usgx-g7dv |
| vulnerability_id |
VCID-38vz-usgx-g7dv |
| summary |
Liferay Portal defaults to a low work factor for the default password hashing algorithm
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 38 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 39 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 40 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 41 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 42 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 43 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 44 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 45 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 46 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 47 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 48 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 49 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 50 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 51 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 52 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 53 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 54 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 55 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 56 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 57 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 58 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 59 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 60 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
|
|
| aliases |
CVE-2024-25607, GHSA-43h9-p3j4-39hm
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-38vz-usgx-g7dv |
|
| 12 |
| url |
VCID-434b-p73k-5fam |
| vulnerability_id |
VCID-434b-p73k-5fam |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43746, GHSA-mpww-r37c-vxjw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-434b-p73k-5fam |
|
| 13 |
| url |
VCID-4611-azkf-sffv |
| vulnerability_id |
VCID-4611-azkf-sffv |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 9 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 10 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 11 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 12 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 13 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 14 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 15 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 16 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 17 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 18 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 19 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 20 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 21 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 22 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 23 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 24 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 25 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 26 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 27 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 28 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 29 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 30 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 31 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 32 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 33 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 34 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 35 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 36 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 37 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 38 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 39 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 40 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 41 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 42 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 43 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 44 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 45 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 46 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 47 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 48 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 49 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 50 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 51 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 52 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 53 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 54 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 55 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 56 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 57 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 58 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 59 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 60 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 61 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 62 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 63 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
|
|
| aliases |
CVE-2023-33939, GHSA-53mw-69qx-q4fc
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4611-azkf-sffv |
|
| 14 |
| url |
VCID-4kym-jhtn-cfa3 |
| vulnerability_id |
VCID-4kym-jhtn-cfa3 |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43741, GHSA-j6p8-g3rj-ghpm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4kym-jhtn-cfa3 |
|
| 15 |
| url |
VCID-4mcy-yw2p-v7bd |
| vulnerability_id |
VCID-4mcy-yw2p-v7bd |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 53 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 54 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 55 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 56 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 57 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 58 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 59 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 60 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 61 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 62 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 63 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 64 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 65 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 68 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 69 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 70 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 71 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
|
|
| aliases |
CVE-2024-25601, GHSA-cr36-3vqf-x5w5
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4mcy-yw2p-v7bd |
|
| 16 |
| url |
VCID-4xqq-69ab-1qew |
| vulnerability_id |
VCID-4xqq-69ab-1qew |
| summary |
Liferay Portal Username Enumeration Vulnerability
Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43754, GHSA-x7p4-v8mj-6fxx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4xqq-69ab-1qew |
|
| 17 |
| url |
VCID-5732-ffyz-9fh5 |
| vulnerability_id |
VCID-5732-ffyz-9fh5 |
| summary |
Liferay Profile Widget does not prevent vCard extension spoofing
The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43824, GHSA-pfxj-gvqg-mj44
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5732-ffyz-9fh5 |
|
| 18 |
| url |
VCID-5bex-xcub-3qhr |
| vulnerability_id |
VCID-5bex-xcub-3qhr |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 12 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 13 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 14 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 15 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 16 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 17 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 18 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 19 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 20 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 21 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 22 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 23 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 24 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 25 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 26 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 27 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 28 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 29 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 30 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 31 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 32 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 33 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 34 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 35 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 36 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 37 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 38 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 39 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 40 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 41 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
|
|
| aliases |
CVE-2024-26273, GHSA-hmrx-6pr5-hpwj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5bex-xcub-3qhr |
|
| 19 |
| url |
VCID-68yp-31d3-zbay |
| vulnerability_id |
VCID-68yp-31d3-zbay |
| summary |
Liferay Portal Uses Default Password
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-43799, GHSA-43xf-59vr-g4f2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-68yp-31d3-zbay |
|
| 20 |
| url |
VCID-6yrk-8tj5-juhp |
| vulnerability_id |
VCID-6yrk-8tj5-juhp |
| summary |
Liferay Portal Vulnerable to CSRF in Headless APIs
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62258, GHSA-gh4w-8qgq-8w9r
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6yrk-8tj5-juhp |
|
| 21 |
| url |
VCID-7tas-6nn4-9fhu |
| vulnerability_id |
VCID-7tas-6nn4-9fhu |
| summary |
Missing permissions check in Liferay Portal
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 18 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 19 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 20 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 21 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 22 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 23 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 29 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 30 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 31 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 32 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 33 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 34 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 35 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 36 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 37 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 38 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 39 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 40 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 41 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 42 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 43 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 44 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 45 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 46 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 47 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 48 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 49 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 50 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 51 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 52 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 53 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 54 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 24 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 25 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 26 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 27 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 28 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 29 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 30 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 31 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 32 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 33 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 34 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 35 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 36 |
| vulnerability |
VCID-mf9a-eusx-f3gb |
|
| 37 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 38 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 39 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 40 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 41 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 42 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 43 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 44 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 45 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 46 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 47 |
| vulnerability |
VCID-uun9-ctyg-k3d9 |
|
| 48 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 49 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 50 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 51 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 52 |
| vulnerability |
VCID-xn3y-rrkc-7bcz |
|
| 53 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 54 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48 |
|
|
| aliases |
CVE-2022-42126, GHSA-642h-mx8q-47p2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7tas-6nn4-9fhu |
|
| 22 |
| url |
VCID-8jv6-163j-a7b2 |
| vulnerability_id |
VCID-8jv6-163j-a7b2 |
| summary |
Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 53 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 54 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 55 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 56 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 57 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 58 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 59 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 60 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 61 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 62 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 63 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 64 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 65 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 68 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 69 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 70 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 71 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
|
|
| aliases |
CVE-2024-25149, GHSA-qpgh-6v9w-vfv6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8jv6-163j-a7b2 |
|
| 23 |
| url |
VCID-8xx2-vtnr-dubu |
| vulnerability_id |
VCID-8xx2-vtnr-dubu |
| summary |
Liferay Portal Login Bypass Vulnerability
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
2.0 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-3639, GHSA-g4wg-mpfg-x2q6
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8xx2-vtnr-dubu |
|
| 24 |
| url |
VCID-9471-umbz-pucy |
| vulnerability_id |
VCID-9471-umbz-pucy |
| summary |
Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 21 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 22 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 23 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 24 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 25 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 26 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 27 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 28 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 29 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 30 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 31 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 32 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 33 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 34 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 35 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 36 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 37 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 38 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 39 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 40 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 41 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 42 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 43 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 44 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 45 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 46 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 47 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 48 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 49 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 50 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 51 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 52 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 53 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 54 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 55 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 56 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 57 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 58 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 59 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 60 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 61 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 62 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 63 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 64 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 65 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
|
|
| aliases |
CVE-2024-25605, GHSA-mf8h-grfg-j9j3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9471-umbz-pucy |
|
| 25 |
| url |
VCID-9yw4-52sc-rbbz |
| vulnerability_id |
VCID-9yw4-52sc-rbbz |
| summary |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 38 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 39 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 40 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 41 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 42 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 43 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 44 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 45 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 46 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 47 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 48 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 49 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 50 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 51 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 52 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 53 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 54 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 55 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 56 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 57 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 58 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 59 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 60 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
|
|
| aliases |
CVE-2024-25609, GHSA-3qq5-wcrx-4h8r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9yw4-52sc-rbbz |
|
| 26 |
| url |
VCID-a7z8-2fzy-2qee |
| vulnerability_id |
VCID-a7z8-2fzy-2qee |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 9 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 10 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 11 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 12 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 13 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 14 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 15 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 21 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 22 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 23 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 24 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 25 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 26 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 27 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 28 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 29 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 30 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 31 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 32 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 33 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 34 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 35 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 36 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 37 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 38 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 39 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 40 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 41 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 42 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 43 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 44 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 45 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 46 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 47 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 48 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 49 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 50 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 51 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 52 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 53 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 54 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 55 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 56 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 57 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 58 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 59 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 60 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 61 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 62 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 63 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 64 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 65 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12 |
|
|
| aliases |
CVE-2024-25145, GHSA-9vgq-w5pv-v77q
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-a7z8-2fzy-2qee |
|
| 27 |
| url |
VCID-afe9-yqy2-8bdb |
| vulnerability_id |
VCID-afe9-yqy2-8bdb |
| summary |
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T16:00:44Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2022-28977, GHSA-w397-9p2j-6x23
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-afe9-yqy2-8bdb |
|
| 28 |
| url |
VCID-b24q-c9nx-hkdy |
| vulnerability_id |
VCID-b24q-c9nx-hkdy |
| summary |
Liferay Portal Stores Password Reset Tokens in Plain Text
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 23 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 24 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 25 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 26 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 27 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 28 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 29 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 30 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 31 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 32 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 33 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 34 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 35 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 36 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 37 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 38 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 39 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 40 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 41 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 42 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 43 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 44 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 45 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
|
|
| aliases |
CVE-2025-62261, GHSA-xcj6-xpjg-c4xr
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-b24q-c9nx-hkdy |
|
| 29 |
| url |
VCID-b7h9-cxkj-hkc8 |
| vulnerability_id |
VCID-b7h9-cxkj-hkc8 |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 53 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 54 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 55 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 56 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 57 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 58 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 59 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 60 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 61 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 62 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 63 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 64 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 65 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 68 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 69 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 70 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 71 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
|
|
| aliases |
CVE-2024-25152, GHSA-p28x-4r5h-ph6j
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-b7h9-cxkj-hkc8 |
|
| 30 |
| url |
VCID-bbzr-zx1c-m3ck |
| vulnerability_id |
VCID-bbzr-zx1c-m3ck |
| summary |
Incorrect Default Permissions in Liferay Portal
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2022-42128, GHSA-wgqm-qp44-cg6x
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bbzr-zx1c-m3ck |
|
| 31 |
| url |
VCID-bg89-tyhn-sfc3 |
| vulnerability_id |
VCID-bg89-tyhn-sfc3 |
| summary |
Authorization Bypass in Liferay Portal
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2022-42129, GHSA-g6x4-57hp-j4xm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bg89-tyhn-sfc3 |
|
| 32 |
| url |
VCID-by7b-2zr9-y3dj |
| vulnerability_id |
VCID-by7b-2zr9-y3dj |
| summary |
Liferay Portal CSRF Vulnerability via Endpoint Parameter
A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43745, GHSA-7q33-gwcm-r6cj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-by7b-2zr9-y3dj |
|
| 33 |
| url |
VCID-ca62-h2qv-v7bg |
| vulnerability_id |
VCID-ca62-h2qv-v7bg |
| summary |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-4655, GHSA-c6g5-g6r7-q4j6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ca62-h2qv-v7bg |
|
| 34 |
| url |
VCID-ce9p-rwsz-zkf6 |
| vulnerability_id |
VCID-ce9p-rwsz-zkf6 |
| summary |
Liferay Portal is vulnerable to Stored XSS through Forms text type field
Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43830, GHSA-378f-8q54-3fqx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ce9p-rwsz-zkf6 |
|
| 35 |
| url |
VCID-cj4m-mvzh-ckh4 |
| vulnerability_id |
VCID-cj4m-mvzh-ckh4 |
| summary |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
4.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 22 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 23 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 29 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 30 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 31 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 32 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 33 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 34 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 35 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 36 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 37 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 38 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 39 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 40 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 45 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 46 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 47 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 48 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 49 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 50 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39 |
|
|
| aliases |
CVE-2024-11993, GHSA-4hxr-28mv-q729
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cj4m-mvzh-ckh4 |
|
| 36 |
| url |
VCID-dt2w-w4vw-1yhe |
| vulnerability_id |
VCID-dt2w-w4vw-1yhe |
| summary |
Path Traversal in Liferay Portal
A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 25 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 26 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 27 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 38 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 39 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 40 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 41 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 42 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 43 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 44 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 45 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 46 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 47 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 48 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 49 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 50 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 51 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 52 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 53 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 54 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 55 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 56 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 57 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 58 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19 |
|
|
| aliases |
CVE-2022-42123, GHSA-hffx-r282-w2g9
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dt2w-w4vw-1yhe |
|
| 37 |
| url |
VCID-e5c7-wsvb-dyfm |
| vulnerability_id |
VCID-e5c7-wsvb-dyfm |
| summary |
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 25 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 26 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 27 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 33 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 34 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 35 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 36 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 37 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 38 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 39 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 40 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 41 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 42 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 43 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 44 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 45 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 46 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 47 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 48 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 49 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 50 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 51 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 52 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 53 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 54 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 55 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 56 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
|
|
| aliases |
CVE-2024-26267, GHSA-2mvj-q2q3-wxjv
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-e5c7-wsvb-dyfm |
|
| 38 |
| url |
VCID-e5h2-wvws-3yhq |
| vulnerability_id |
VCID-e5h2-wvws-3yhq |
| summary |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 29 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 30 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 31 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 32 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 33 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 34 |
| vulnerability |
VCID-mf9a-eusx-f3gb |
|
| 35 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 36 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 37 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 38 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 39 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 40 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 41 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 42 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 43 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 44 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 45 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 46 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 47 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 48 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 49 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 50 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 51 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88 |
|
|
| aliases |
CVE-2023-37940, GHSA-px38-239g-x5mg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-e5h2-wvws-3yhq |
|
| 39 |
| url |
VCID-ebzh-bpks-5qe2 |
| vulnerability_id |
VCID-ebzh-bpks-5qe2 |
| summary |
Liferay Cross-site Scripting vulnerability
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-3760, GHSA-qhp6-vp7c-g7xp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ebzh-bpks-5qe2 |
|
| 40 |
| url |
VCID-evap-nt9g-akf6 |
| vulnerability_id |
VCID-evap-nt9g-akf6 |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43731, GHSA-3p2m-574v-v257
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-evap-nt9g-akf6 |
|
| 41 |
| url |
VCID-g41m-xvk2-xfda |
| vulnerability_id |
VCID-g41m-xvk2-xfda |
| summary |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43734, GHSA-m5c7-5gv3-hcpf
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g41m-xvk2-xfda |
|
| 42 |
| url |
VCID-gaqh-vn1h-b3c1 |
| vulnerability_id |
VCID-gaqh-vn1h-b3c1 |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 29 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 30 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 31 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 32 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 33 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 34 |
| vulnerability |
VCID-mf9a-eusx-f3gb |
|
| 35 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 36 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 37 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 38 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 39 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 40 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-uun9-ctyg-k3d9 |
|
| 45 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 46 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 47 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 48 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 49 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69 |
|
|
| aliases |
CVE-2023-33944, GHSA-pfwc-4frf-4gf8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gaqh-vn1h-b3c1 |
|
| 43 |
| url |
VCID-ggmh-6ef8-7ufj |
| vulnerability_id |
VCID-ggmh-6ef8-7ufj |
| summary |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-4581, GHSA-6v93-frf9-2rp8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ggmh-6ef8-7ufj |
|
| 44 |
| url |
VCID-ggs5-4zac-vqa7 |
| vulnerability_id |
VCID-ggs5-4zac-vqa7 |
| summary |
Liferay Portal denial-of-service vulnerability
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 25 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 26 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 27 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 33 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 34 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 35 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 36 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 37 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 38 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 39 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 40 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 41 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 42 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 43 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 44 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 45 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 46 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 47 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 48 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 49 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 50 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 51 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 52 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 53 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 54 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 55 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 56 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27 |
|
|
| aliases |
CVE-2024-25144, GHSA-w275-m8cr-hf2v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ggs5-4zac-vqa7 |
|
| 45 |
| url |
VCID-gyge-7d5c-6uhz |
| vulnerability_id |
VCID-gyge-7d5c-6uhz |
| summary |
Liferay Portal's Unlimited File Upload Could Result in DoS
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43752, GHSA-qpp6-f3qj-rggq
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gyge-7d5c-6uhz |
|
| 46 |
| url |
VCID-h261-uqtv-yfek |
| vulnerability_id |
VCID-h261-uqtv-yfek |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 53 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 54 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 55 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 56 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 57 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 58 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 59 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 60 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 61 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 62 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 63 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 64 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 65 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 68 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 69 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 70 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 71 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1 |
|
|
| aliases |
CVE-2024-25602, GHSA-v2xq-m22w-jmpr
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h261-uqtv-yfek |
|
| 47 |
| url |
VCID-hhmu-vsj9-gudx |
| vulnerability_id |
VCID-hhmu-vsj9-gudx |
| summary |
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 9 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 10 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 11 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 12 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 13 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 14 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 15 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 16 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 17 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 18 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 19 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 20 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 21 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 22 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 23 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 24 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 25 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 26 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 27 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 28 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 29 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 30 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 31 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 32 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 33 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 34 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 35 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 36 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 37 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 38 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 39 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 40 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 41 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 42 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 43 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 44 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 45 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 46 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 47 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 48 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 49 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 50 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 51 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 52 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 53 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 54 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 55 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 56 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 57 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 58 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 59 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 60 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 61 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 62 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 63 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13 |
|
|
| aliases |
CVE-2024-25610, GHSA-vvpf-53qx-cxhh
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hhmu-vsj9-gudx |
|
| 48 |
| url |
VCID-hrnu-4t2j-9qba |
| vulnerability_id |
VCID-hrnu-4t2j-9qba |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2fn6-apud-qbh4 |
|
| 9 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 10 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 11 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 12 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 13 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 14 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 15 |
| vulnerability |
VCID-4mcy-yw2p-v7bd |
|
| 16 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 17 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 18 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 19 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 20 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 21 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 22 |
| vulnerability |
VCID-8jv6-163j-a7b2 |
|
| 23 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 24 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 25 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 26 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 27 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 28 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 29 |
| vulnerability |
VCID-b7h9-cxkj-hkc8 |
|
| 30 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 31 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 32 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 33 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 34 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 35 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 36 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 37 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 38 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 39 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 40 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 41 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 42 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 43 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 44 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 45 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 46 |
| vulnerability |
VCID-h261-uqtv-yfek |
|
| 47 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 48 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 49 |
| vulnerability |
VCID-hw1d-gdcv-vkec |
|
| 50 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 51 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 52 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 53 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 54 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 55 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 56 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 57 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 58 |
| vulnerability |
VCID-p9am-1rhf-6bh2 |
|
| 59 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 60 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 61 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 62 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 63 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 64 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 65 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 66 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 67 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 68 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 69 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 70 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 71 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 72 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 73 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 74 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 75 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 76 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 77 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 78 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1 |
|
|
| aliases |
CVE-2024-25147, GHSA-xpjg-7hx7-wgcx
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hrnu-4t2j-9qba |
|
| 49 |
| url |
VCID-hvpx-y297-sbha |
| vulnerability_id |
VCID-hvpx-y297-sbha |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2024-26272, GHSA-p63m-vmjr-wg37
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hvpx-y297-sbha |
|
| 50 |
| url |
VCID-hw1d-gdcv-vkec |
| vulnerability_id |
VCID-hw1d-gdcv-vkec |
| summary |
Liferay Portal vulnerable to user impersonation
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
|
| 1 |
| value |
8.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2fn6-apud-qbh4 |
|
| 9 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 10 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 11 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 12 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 13 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 14 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 15 |
| vulnerability |
VCID-4mcy-yw2p-v7bd |
|
| 16 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 17 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 18 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 19 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 20 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 21 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 22 |
| vulnerability |
VCID-8jv6-163j-a7b2 |
|
| 23 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 24 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 25 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 26 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 27 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 28 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 29 |
| vulnerability |
VCID-b7h9-cxkj-hkc8 |
|
| 30 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 31 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 32 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 33 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 34 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 35 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 36 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 37 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 38 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 39 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 40 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 41 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 42 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 43 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 44 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 45 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 46 |
| vulnerability |
VCID-h261-uqtv-yfek |
|
| 47 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 48 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 49 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 50 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 51 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 52 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 53 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 54 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 55 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 56 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 57 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 58 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 59 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 60 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 61 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 62 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 63 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 64 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 65 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 66 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 67 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 68 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 69 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 70 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 71 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 72 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 73 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 74 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 75 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 76 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
|
|
| aliases |
CVE-2024-25148, GHSA-qwj8-qgpr-8crm
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hw1d-gdcv-vkec |
|
| 51 |
| url |
VCID-j3pc-gwg6-qfbs |
| vulnerability_id |
VCID-j3pc-gwg6-qfbs |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels
A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43744, GHSA-m49p-6cjp-x2h3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j3pc-gwg6-qfbs |
|
| 52 |
| url |
VCID-k1u8-ur3y-zucd |
| vulnerability_id |
VCID-k1u8-ur3y-zucd |
| summary |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 21 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 22 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 23 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 24 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 25 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 26 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 27 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 28 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 29 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 30 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 31 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 32 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 33 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 34 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 35 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 36 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 37 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 38 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 39 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 40 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 41 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 42 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 43 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 44 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 45 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 46 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 47 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 48 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 49 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 50 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 51 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 52 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 53 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 54 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 55 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 56 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 57 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 58 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 59 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 60 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 61 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 62 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 63 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 64 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 65 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
|
|
| aliases |
CVE-2022-42132, GHSA-f43m-hhj4-q3jg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k1u8-ur3y-zucd |
|
| 53 |
| url |
VCID-k9yt-aj7x-3bht |
| vulnerability_id |
VCID-k9yt-aj7x-3bht |
| summary |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 25 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 26 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 27 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 37 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 38 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 39 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 40 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 41 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 42 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 43 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 44 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 45 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 46 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 47 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 48 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 49 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 50 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 51 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 52 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 53 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 54 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 55 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 56 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 57 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20 |
|
|
| aliases |
CVE-2024-25608, GHSA-548x-j6x6-hcv4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k9yt-aj7x-3bht |
|
| 54 |
| url |
VCID-kjbx-n3pd-yba9 |
| vulnerability_id |
VCID-kjbx-n3pd-yba9 |
| summary |
Liferay Portal vulnerable to Denial of Service
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.0 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 38 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 39 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 40 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 41 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 42 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 43 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 44 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 45 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 46 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 47 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 48 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 49 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 50 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 51 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 52 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 53 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 54 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 55 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 56 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 57 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 58 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 59 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
|
|
| aliases |
CVE-2024-26265, GHSA-29xx-fhff-36m7
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kjbx-n3pd-yba9 |
|
| 55 |
| url |
VCID-ksvn-b6hv-hfa7 |
| vulnerability_id |
VCID-ksvn-b6hv-hfa7 |
| summary |
Liferay Portal Enumeration Discrepancy in Calendars
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43743, GHSA-g4vp-4gqr-7v8c
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ksvn-b6hv-hfa7 |
|
| 56 |
| url |
VCID-mcea-q7za-duay |
| vulnerability_id |
VCID-mcea-q7za-duay |
| summary |
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 21 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 22 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 23 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 24 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 25 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 26 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 27 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 28 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 29 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 30 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 31 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 32 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 33 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 34 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 35 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 36 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 37 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 38 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 39 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 40 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 41 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 42 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 43 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 44 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 45 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 46 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 47 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 48 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 49 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 50 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 51 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 52 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 53 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 54 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 55 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 56 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 57 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 58 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 59 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 60 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 61 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 62 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 63 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 64 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 65 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6 |
|
|
| aliases |
CVE-2024-25604, GHSA-pw7p-3648-qqmg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mcea-q7za-duay |
|
| 57 |
| url |
VCID-msd2-mccp-z7cv |
| vulnerability_id |
VCID-msd2-mccp-z7cv |
| summary |
Liferay Portal Missing Authorization vulnerability
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 18 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 19 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 20 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 21 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 22 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 23 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 29 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 30 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 31 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 32 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 33 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 34 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 35 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 36 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 37 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 38 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 39 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 40 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 41 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 42 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 43 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 44 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 45 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 46 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 47 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 48 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 49 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 50 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 51 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 52 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35 |
|
|
| aliases |
CVE-2022-39975, GHSA-83qx-288m-72w4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-msd2-mccp-z7cv |
|
| 58 |
| url |
VCID-nhp5-61h7-ryf4 |
| vulnerability_id |
VCID-nhp5-61h7-ryf4 |
| summary |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43735, GHSA-222w-xmc5-jhp3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nhp5-61h7-ryf4 |
|
| 59 |
| url |
VCID-p9am-1rhf-6bh2 |
| vulnerability_id |
VCID-p9am-1rhf-6bh2 |
| summary |
Observable Response Discrepancy
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2fn6-apud-qbh4 |
|
| 9 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 10 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 11 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 12 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 13 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 14 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 15 |
| vulnerability |
VCID-4mcy-yw2p-v7bd |
|
| 16 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 17 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 18 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 19 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 20 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 21 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 22 |
| vulnerability |
VCID-8jv6-163j-a7b2 |
|
| 23 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 24 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 25 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 26 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 27 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 28 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 29 |
| vulnerability |
VCID-b7h9-cxkj-hkc8 |
|
| 30 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 31 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 32 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 33 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 34 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 35 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 36 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 37 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 38 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 39 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 40 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 41 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 42 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 43 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 44 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 45 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 46 |
| vulnerability |
VCID-h261-uqtv-yfek |
|
| 47 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 48 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 49 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 50 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 51 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 52 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 53 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 54 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 55 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 56 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 57 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 58 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 59 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 60 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 61 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 62 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 63 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 64 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 65 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 66 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 67 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 68 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 69 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 70 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 71 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 72 |
| vulnerability |
VCID-xuaz-p5q4-8beh |
|
| 73 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 74 |
| vulnerability |
VCID-y8xm-g4zt-b7b5 |
|
| 75 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 76 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2 |
|
|
| aliases |
CVE-2024-25146, GHSA-mqf8-4cqm-p83x
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p9am-1rhf-6bh2 |
|
| 60 |
| url |
VCID-pczz-39pz-37bb |
| vulnerability_id |
VCID-pczz-39pz-37bb |
| summary |
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2024-25603, GHSA-44jg-jgjx-3xg5
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pczz-39pz-37bb |
|
| 61 |
| url |
VCID-pdbx-p4mr-97h4 |
| vulnerability_id |
VCID-pdbx-p4mr-97h4 |
| summary |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 29 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 30 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 31 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 32 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 33 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 34 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 35 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 36 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 37 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 38 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 39 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 40 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 41 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 42 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 43 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 44 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 45 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 46 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 47 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 48 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 49 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 50 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 51 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 52 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 53 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 54 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 55 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 56 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 57 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 58 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 59 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18 |
|
|
| aliases |
CVE-2023-33945, GHSA-g7vw-43xg-8m4h
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pdbx-p4mr-97h4 |
|
| 62 |
| url |
VCID-pf71-p73a-xyda |
| vulnerability_id |
VCID-pf71-p73a-xyda |
| summary |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-43813, GHSA-2hm7-r8f3-423h
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pf71-p73a-xyda |
|
| 63 |
| url |
VCID-qks2-mqk8-wffq |
| vulnerability_id |
VCID-qks2-mqk8-wffq |
| summary |
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 24 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 25 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 26 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 27 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 28 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 29 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 30 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 31 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 32 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 33 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 34 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 35 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 36 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 37 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 38 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 39 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 40 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 41 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 42 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 43 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 44 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 45 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 46 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 47 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 48 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 49 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 50 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 51 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38 |
|
|
| aliases |
CVE-2024-26269, GHSA-rwhv-hvj2-qrqm
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qks2-mqk8-wffq |
|
| 64 |
| url |
VCID-qrgm-94me-83hz |
| vulnerability_id |
VCID-qrgm-94me-83hz |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 18 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 19 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 20 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 21 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 22 |
| vulnerability |
VCID-dvp1-5vf5-qfg9 |
|
| 23 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 29 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 30 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 31 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 32 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 33 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 34 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 35 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 36 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 37 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 38 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 39 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 40 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 41 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 42 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 43 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 44 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 45 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 46 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 47 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 48 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 49 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 50 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 51 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 52 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 53 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31 |
|
|
| aliases |
CVE-2023-33940, GHSA-x82q-mr23-27jc
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qrgm-94me-83hz |
|
| 65 |
| url |
VCID-qy5u-7m7g-4ben |
| vulnerability_id |
VCID-qy5u-7m7g-4ben |
| summary |
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget
Cross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43823, GHSA-xx7h-2wf7-hc7p
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qy5u-7m7g-4ben |
|
| 66 |
| url |
VCID-r363-kggk-k3ds |
| vulnerability_id |
VCID-r363-kggk-k3ds |
| summary |
Liferay Portal is vulnerable to XSS in the Blogs widget
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.
The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-62265, GHSA-56jv-4ww3-65mw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r363-kggk-k3ds |
|
| 67 |
| url |
VCID-rns1-e6pd-tkex |
| vulnerability_id |
VCID-rns1-e6pd-tkex |
| summary |
Liferay Portal Vulnerable to XSS in Web Content translation
Stored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 3 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 4 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 5 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 6 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 7 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 8 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 9 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 10 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 11 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 12 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 13 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 14 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 15 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 16 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 17 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 18 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 19 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 20 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
|
|
| aliases |
CVE-2025-43826, GHSA-qh92-cr5f-3595
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rns1-e6pd-tkex |
|
| 68 |
| url |
VCID-sw28-urg9-tqgd |
| vulnerability_id |
VCID-sw28-urg9-tqgd |
| summary |
Liferay Portal and Liferay DXP Reveals Data via Forms
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-2565, GHSA-9fcg-wrp8-qhr4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sw28-urg9-tqgd |
|
| 69 |
| url |
VCID-tf5n-etq9-2bg1 |
| vulnerability_id |
VCID-tf5n-etq9-2bg1 |
| summary |
Liferay Portal Does Not Limit Access to APIs Before Email Verification
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62259, GHSA-gv7w-jh8g-vr73
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tf5n-etq9-2bg1 |
|
| 70 |
| url |
VCID-turp-jxv8-1fgy |
| vulnerability_id |
VCID-turp-jxv8-1fgy |
| summary |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 23 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 24 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 25 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 26 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 27 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 28 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 29 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 30 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 31 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 32 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 33 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 34 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 35 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 36 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 37 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 38 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 39 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 40 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 41 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 42 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
|
|
| aliases |
CVE-2024-8980, GHSA-chj2-4vg7-hhg3
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-turp-jxv8-1fgy |
|
| 71 |
| url |
VCID-vez2-knrw-ubbe |
| vulnerability_id |
VCID-vez2-knrw-ubbe |
| summary |
Privilege escalation in Liferay Portal
Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 38 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 39 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 40 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 41 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 42 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 43 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 44 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 45 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 46 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 47 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 48 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 49 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 50 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 51 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 52 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 53 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 54 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 55 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 56 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 57 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 58 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 59 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16 |
|
|
| aliases |
CVE-2022-45320, GHSA-mc8m-4r3w-q2hw
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vez2-knrw-ubbe |
|
| 72 |
| url |
VCID-w7z4-h1ug-z3cq |
| vulnerability_id |
VCID-w7z4-h1ug-z3cq |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.8 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43757, GHSA-62pf-hcwj-rcfc
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w7z4-h1ug-z3cq |
|
| 73 |
| url |
VCID-wpqk-8fd9-p3ex |
| vulnerability_id |
VCID-wpqk-8fd9-p3ex |
| summary |
Liferay Portal Unauthenticated File Access via URL
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43749, GHSA-5fx5-cff6-f3fp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wpqk-8fd9-p3ex |
|
| 74 |
| url |
VCID-xn1n-5rgc-83bg |
| vulnerability_id |
VCID-xn1n-5rgc-83bg |
| summary |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 24 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 25 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 26 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 27 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 28 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 29 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 30 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 31 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 32 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 33 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 34 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 35 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 36 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 37 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 38 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 39 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 40 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 45 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 46 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 47 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 48 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
|
|
| aliases |
CVE-2023-42496, GHSA-54pv-r62j-9qqc
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xn1n-5rgc-83bg |
|
| 75 |
| url |
VCID-xuaz-p5q4-8beh |
| vulnerability_id |
VCID-xuaz-p5q4-8beh |
| summary |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 53 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 54 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 55 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 56 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 57 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 58 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 59 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 60 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 61 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 62 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 63 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 64 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 65 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 66 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 67 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 68 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 69 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 70 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 71 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 72 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
|
|
| aliases |
CVE-2024-25151, GHSA-hgr6-6hhw-883f
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xuaz-p5q4-8beh |
|
| 76 |
| url |
VCID-y1wd-arvg-2ugt |
| vulnerability_id |
VCID-y1wd-arvg-2ugt |
| summary |
Liferay Portal is vulnerable to DNS rebinding attacks
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62266, GHSA-f5vh-4rj2-w8r8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y1wd-arvg-2ugt |
|
| 77 |
| url |
VCID-y8xm-g4zt-b7b5 |
| vulnerability_id |
VCID-y8xm-g4zt-b7b5 |
| summary |
Improper Certificate Validation in Liferay Portal
Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-266t-4gfq-duh4 |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-37ph-hjq9-bufq |
|
| 10 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 11 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 12 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 13 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 14 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 15 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 16 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 17 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 18 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 19 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 20 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 21 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 22 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 23 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 24 |
| vulnerability |
VCID-afe9-yqy2-8bdb |
|
| 25 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 26 |
| vulnerability |
VCID-bbzr-zx1c-m3ck |
|
| 27 |
| vulnerability |
VCID-bg89-tyhn-sfc3 |
|
| 28 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 29 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 30 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 31 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 32 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 33 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 34 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 35 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 36 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 37 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 38 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 39 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 40 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 41 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 42 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 43 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 44 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 45 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 46 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 47 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 48 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 49 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 50 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 51 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 52 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 53 |
| vulnerability |
VCID-pczz-39pz-37bb |
|
| 54 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 55 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 56 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 57 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 58 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 59 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 60 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 61 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 62 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 63 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 64 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 65 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 66 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 67 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 68 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 69 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 70 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 71 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
| 72 |
| vulnerability |
VCID-zmf4-acz8-s3a2 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4 |
|
|
| aliases |
CVE-2022-42131, GHSA-cx84-43xc-3gm2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y8xm-g4zt-b7b5 |
|
| 78 |
| url |
VCID-ydhb-8z5m-v7fb |
| vulnerability_id |
VCID-ydhb-8z5m-v7fb |
| summary |
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 6 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 7 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 17 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 18 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 25 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 26 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 27 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 28 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 29 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 30 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 31 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 32 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 33 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 34 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 35 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 36 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 37 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 38 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 39 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 40 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 41 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 42 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 43 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 44 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 45 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 46 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 47 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 48 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 49 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 50 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 51 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 52 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 53 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 54 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 55 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 56 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 57 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 58 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 59 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 60 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14 |
|
|
| aliases |
CVE-2024-26266, GHSA-rwxc-4cmw-7x75
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ydhb-8z5m-v7fb |
|
| 79 |
| url |
VCID-zmf4-acz8-s3a2 |
| vulnerability_id |
VCID-zmf4-acz8-s3a2 |
| summary |
Incorrect Default Permissions in Liferay Portal
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries. |
| references |
| 0 |
| reference_url |
http://liferay.com |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/ |
|
|
| url |
http://liferay.com |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1fqz-psdf-g7dm |
|
| 2 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 3 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 4 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 5 |
| vulnerability |
VCID-298n-mh47-3ygq |
|
| 6 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 7 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 8 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 9 |
| vulnerability |
VCID-38vz-usgx-g7dv |
|
| 10 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 11 |
| vulnerability |
VCID-4611-azkf-sffv |
|
| 12 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 13 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 14 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 15 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 16 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 17 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 18 |
| vulnerability |
VCID-7tas-6nn4-9fhu |
|
| 19 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 20 |
| vulnerability |
VCID-9471-umbz-pucy |
|
| 21 |
| vulnerability |
VCID-9yw4-52sc-rbbz |
|
| 22 |
| vulnerability |
VCID-a7z8-2fzy-2qee |
|
| 23 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 24 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 25 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 26 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 27 |
| vulnerability |
VCID-cj4m-mvzh-ckh4 |
|
| 28 |
| vulnerability |
VCID-dt2w-w4vw-1yhe |
|
| 29 |
| vulnerability |
VCID-e5c7-wsvb-dyfm |
|
| 30 |
| vulnerability |
VCID-e5h2-wvws-3yhq |
|
| 31 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 32 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 33 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 34 |
| vulnerability |
VCID-gaqh-vn1h-b3c1 |
|
| 35 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 36 |
| vulnerability |
VCID-ggs5-4zac-vqa7 |
|
| 37 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 38 |
| vulnerability |
VCID-hhmu-vsj9-gudx |
|
| 39 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 40 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 41 |
| vulnerability |
VCID-k1u8-ur3y-zucd |
|
| 42 |
| vulnerability |
VCID-k9yt-aj7x-3bht |
|
| 43 |
| vulnerability |
VCID-kjbx-n3pd-yba9 |
|
| 44 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 45 |
| vulnerability |
VCID-mcea-q7za-duay |
|
| 46 |
| vulnerability |
VCID-mgw3-28sj-juh7 |
|
| 47 |
| vulnerability |
VCID-msd2-mccp-z7cv |
|
| 48 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 49 |
| vulnerability |
VCID-patg-tmcj-3qbh |
|
| 50 |
| vulnerability |
VCID-pdbx-p4mr-97h4 |
|
| 51 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 52 |
| vulnerability |
VCID-qks2-mqk8-wffq |
|
| 53 |
| vulnerability |
VCID-qrgm-94me-83hz |
|
| 54 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 55 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 56 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 57 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 58 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 59 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 60 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 61 |
| vulnerability |
VCID-v633-mycj-6uh6 |
|
| 62 |
| vulnerability |
VCID-vez2-knrw-ubbe |
|
| 63 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 64 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 65 |
| vulnerability |
VCID-wzj5-ba9k-q3at |
|
| 66 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 67 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 68 |
| vulnerability |
VCID-ydhb-8z5m-v7fb |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5 |
|
|
| aliases |
CVE-2022-42130, GHSA-mxvq-cv4x-p3jw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zmf4-acz8-s3a2 |
|
|
|---|