| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-11qf-d5xp-4fey |
| vulnerability_id |
VCID-11qf-d5xp-4fey |
| summary |
Liferay Portal vulnerable to cross-site scripting in the web content template
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43812, GHSA-jv8x-mm3v-75r7
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-11qf-d5xp-4fey |
|
| 1 |
| url |
VCID-1jgz-k7zp-uydp |
| vulnerability_id |
VCID-1jgz-k7zp-uydp |
| summary |
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2024-38002, GHSA-3mfq-fp2f-vwqh
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1jgz-k7zp-uydp |
|
| 2 |
| url |
VCID-27a1-teqk-cbe2 |
| vulnerability_id |
VCID-27a1-teqk-cbe2 |
| summary |
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
A stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43776, GHSA-rcc7-jx7p-hrv4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-27a1-teqk-cbe2 |
|
| 3 |
| url |
VCID-292m-hgvs-93ey |
| vulnerability_id |
VCID-292m-hgvs-93ey |
| summary |
Liferay Portal Vulnerable to DoS via Crafted Headless API Request
Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 23 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 24 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 25 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 26 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 27 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 28 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 29 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 30 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 31 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 32 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 33 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 34 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 35 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 36 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 37 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 38 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 39 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 40 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 41 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 42 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 43 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 44 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 45 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
|
|
| aliases |
CVE-2025-62260, GHSA-vgqx-447m-wvcj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-292m-hgvs-93ey |
|
| 4 |
| url |
VCID-2bcr-bxek-skfq |
| vulnerability_id |
VCID-2bcr-bxek-skfq |
| summary |
Liferay Portal vulnerable to password enumeration
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 3 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 4 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 5 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 6 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 7 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 8 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 9 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 10 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 11 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 12 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 13 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 14 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 15 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 16 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 17 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 18 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 19 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 20 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
|
|
| aliases |
CVE-2025-62257, GHSA-8hw3-ghwv-crfh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2bcr-bxek-skfq |
|
| 5 |
| url |
VCID-2dra-x6f5-xybz |
| vulnerability_id |
VCID-2dra-x6f5-xybz |
| summary |
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43760, GHSA-fvqv-593q-qp8r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2dra-x6f5-xybz |
|
| 6 |
| url |
VCID-2mtb-mdha-qufv |
| vulnerability_id |
VCID-2mtb-mdha-qufv |
| summary |
Liferay Portal Vulnerable to Cross-Site Request Forgery
Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 3 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 4 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 5 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 6 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 7 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 8 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 9 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 10 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 11 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 12 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 13 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 14 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 15 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 16 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 17 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 18 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 19 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 20 |
| vulnerability |
VCID-u1pr-9cpx-q3hg |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125 |
|
|
| aliases |
CVE-2025-43748, GHSA-p9gc-59hf-x48p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2mtb-mdha-qufv |
|
| 7 |
| url |
VCID-3hm3-htje-akgd |
| vulnerability_id |
VCID-3hm3-htje-akgd |
| summary |
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-43820, GHSA-pf86-4w35-cj89
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3hm3-htje-akgd |
|
| 8 |
| url |
VCID-434b-p73k-5fam |
| vulnerability_id |
VCID-434b-p73k-5fam |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43746, GHSA-mpww-r37c-vxjw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-434b-p73k-5fam |
|
| 9 |
| url |
VCID-4kym-jhtn-cfa3 |
| vulnerability_id |
VCID-4kym-jhtn-cfa3 |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43741, GHSA-j6p8-g3rj-ghpm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4kym-jhtn-cfa3 |
|
| 10 |
| url |
VCID-4xqq-69ab-1qew |
| vulnerability_id |
VCID-4xqq-69ab-1qew |
| summary |
Liferay Portal Username Enumeration Vulnerability
Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43754, GHSA-x7p4-v8mj-6fxx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4xqq-69ab-1qew |
|
| 11 |
| url |
VCID-5732-ffyz-9fh5 |
| vulnerability_id |
VCID-5732-ffyz-9fh5 |
| summary |
Liferay Profile Widget does not prevent vCard extension spoofing
The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43824, GHSA-pfxj-gvqg-mj44
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5732-ffyz-9fh5 |
|
| 12 |
| url |
VCID-5bex-xcub-3qhr |
| vulnerability_id |
VCID-5bex-xcub-3qhr |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 12 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 13 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 14 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 15 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 16 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 17 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 18 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 19 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 20 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 21 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 22 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 23 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 24 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 25 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 26 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 27 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 28 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 29 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 30 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 31 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 32 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 33 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 34 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 35 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 36 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 37 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 38 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 39 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 40 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 41 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104 |
|
|
| aliases |
CVE-2024-26273, GHSA-hmrx-6pr5-hpwj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5bex-xcub-3qhr |
|
| 13 |
| url |
VCID-5nq8-gsav-5ffq |
| vulnerability_id |
VCID-5nq8-gsav-5ffq |
| summary |
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 24 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 25 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 26 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 27 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 28 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 29 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 30 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 31 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 32 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 33 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 34 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 35 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 36 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 37 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 38 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 39 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 40 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 45 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 46 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 47 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 48 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
|
|
| aliases |
CVE-2023-42498, GHSA-73x3-8mrg-5r93
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5nq8-gsav-5ffq |
|
| 14 |
| url |
VCID-68yp-31d3-zbay |
| vulnerability_id |
VCID-68yp-31d3-zbay |
| summary |
Liferay Portal Uses Default Password
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-43799, GHSA-43xf-59vr-g4f2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-68yp-31d3-zbay |
|
| 15 |
| url |
VCID-6yrk-8tj5-juhp |
| vulnerability_id |
VCID-6yrk-8tj5-juhp |
| summary |
Liferay Portal Vulnerable to CSRF in Headless APIs
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62258, GHSA-gh4w-8qgq-8w9r
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6yrk-8tj5-juhp |
|
| 16 |
| url |
VCID-8xx2-vtnr-dubu |
| vulnerability_id |
VCID-8xx2-vtnr-dubu |
| summary |
Liferay Portal Login Bypass Vulnerability
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
2.0 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-3639, GHSA-g4wg-mpfg-x2q6
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8xx2-vtnr-dubu |
|
| 17 |
| url |
VCID-b24q-c9nx-hkdy |
| vulnerability_id |
VCID-b24q-c9nx-hkdy |
| summary |
Liferay Portal Stores Password Reset Tokens in Plain Text
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 23 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 24 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 25 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 26 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 27 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 28 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 29 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 30 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 31 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 32 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 33 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 34 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 35 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 36 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 37 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 38 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 39 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 40 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 41 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 42 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 43 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 44 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 45 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
|
|
| aliases |
CVE-2025-62261, GHSA-xcj6-xpjg-c4xr
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-b24q-c9nx-hkdy |
|
| 18 |
| url |
VCID-brjh-tyur-ebc8 |
| vulnerability_id |
VCID-brjh-tyur-ebc8 |
| summary |
Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43785, GHSA-66x6-8jgv-qpfh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-brjh-tyur-ebc8 |
|
| 19 |
| url |
VCID-by7b-2zr9-y3dj |
| vulnerability_id |
VCID-by7b-2zr9-y3dj |
| summary |
Liferay Portal CSRF Vulnerability via Endpoint Parameter
A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43745, GHSA-7q33-gwcm-r6cj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-by7b-2zr9-y3dj |
|
| 20 |
| url |
VCID-ca62-h2qv-v7bg |
| vulnerability_id |
VCID-ca62-h2qv-v7bg |
| summary |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-4655, GHSA-c6g5-g6r7-q4j6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ca62-h2qv-v7bg |
|
| 21 |
| url |
VCID-ce9p-rwsz-zkf6 |
| vulnerability_id |
VCID-ce9p-rwsz-zkf6 |
| summary |
Liferay Portal is vulnerable to Stored XSS through Forms text type field
Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43830, GHSA-378f-8q54-3fqx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| url |
VCID-csnj-331s-43ea |
| vulnerability_id |
VCID-csnj-331s-43ea |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-2536, GHSA-hrc4-p2h3-pjqw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-csnj-331s-43ea |
|
| 23 |
| url |
VCID-d56y-s4zt-uyd7 |
| vulnerability_id |
VCID-d56y-s4zt-uyd7 |
| summary |
Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter
Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-62264, GHSA-2j97-4jmq-c4xf
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d56y-s4zt-uyd7 |
|
| 24 |
| url |
VCID-ebzh-bpks-5qe2 |
| vulnerability_id |
VCID-ebzh-bpks-5qe2 |
| summary |
Liferay Cross-site Scripting vulnerability
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-3760, GHSA-qhp6-vp7c-g7xp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ebzh-bpks-5qe2 |
|
| 25 |
| url |
VCID-ej5y-geq1-pkfn |
| vulnerability_id |
VCID-ej5y-geq1-pkfn |
| summary |
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 23 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 24 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 25 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 26 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 27 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 28 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 29 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 30 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 31 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 32 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 33 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 34 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 35 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 36 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 37 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 38 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 39 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 40 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 41 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 42 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 43 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 44 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102 |
|
|
| aliases |
CVE-2023-47795, GHSA-q2cv-7j58-rfmj
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ej5y-geq1-pkfn |
|
| 26 |
| url |
VCID-evap-nt9g-akf6 |
| vulnerability_id |
VCID-evap-nt9g-akf6 |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43731, GHSA-3p2m-574v-v257
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-evap-nt9g-akf6 |
|
| 27 |
| url |
VCID-g41m-xvk2-xfda |
| vulnerability_id |
VCID-g41m-xvk2-xfda |
| summary |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43734, GHSA-m5c7-5gv3-hcpf
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g41m-xvk2-xfda |
|
| 28 |
| url |
VCID-ggmh-6ef8-7ufj |
| vulnerability_id |
VCID-ggmh-6ef8-7ufj |
| summary |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-4581, GHSA-6v93-frf9-2rp8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ggmh-6ef8-7ufj |
|
| 29 |
| url |
VCID-gyge-7d5c-6uhz |
| vulnerability_id |
VCID-gyge-7d5c-6uhz |
| summary |
Liferay Portal's Unlimited File Upload Could Result in DoS
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43752, GHSA-qpp6-f3qj-rggq
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gyge-7d5c-6uhz |
|
| 30 |
| url |
VCID-hvpx-y297-sbha |
| vulnerability_id |
VCID-hvpx-y297-sbha |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2024-26272, GHSA-p63m-vmjr-wg37
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hvpx-y297-sbha |
|
| 31 |
| url |
VCID-j3pc-gwg6-qfbs |
| vulnerability_id |
VCID-j3pc-gwg6-qfbs |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels
A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43744, GHSA-m49p-6cjp-x2h3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j3pc-gwg6-qfbs |
|
| 32 |
| url |
VCID-ksvn-b6hv-hfa7 |
| vulnerability_id |
VCID-ksvn-b6hv-hfa7 |
| summary |
Liferay Portal Enumeration Discrepancy in Calendars
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43743, GHSA-g4vp-4gqr-7v8c
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ksvn-b6hv-hfa7 |
|
| 33 |
| url |
VCID-mbd8-z3ry-cqap |
| vulnerability_id |
VCID-mbd8-z3ry-cqap |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 23 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 24 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 25 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 26 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 27 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 28 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 29 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 30 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 31 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 32 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 33 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 34 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 35 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 36 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 37 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 38 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 39 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 40 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 41 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 42 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
|
|
| aliases |
CVE-2023-5190, GHSA-f3rf-cr7f-cwc4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mbd8-z3ry-cqap |
|
| 34 |
| url |
VCID-mf9a-eusx-f3gb |
| vulnerability_id |
VCID-mf9a-eusx-f3gb |
| summary |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 24 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 25 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 26 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 27 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 28 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 29 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 30 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 31 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 32 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 33 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 34 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 35 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 36 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 37 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 38 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 39 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 40 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 45 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 46 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 47 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 48 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
|
|
| aliases |
CVE-2023-40191, GHSA-468x-frcm-ghx6
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mf9a-eusx-f3gb |
|
| 35 |
| url |
VCID-nhp5-61h7-ryf4 |
| vulnerability_id |
VCID-nhp5-61h7-ryf4 |
| summary |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43735, GHSA-222w-xmc5-jhp3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nhp5-61h7-ryf4 |
|
| 36 |
| url |
VCID-pf71-p73a-xyda |
| vulnerability_id |
VCID-pf71-p73a-xyda |
| summary |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-43813, GHSA-2hm7-r8f3-423h
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pf71-p73a-xyda |
|
| 37 |
| url |
VCID-q9et-6dxx-zbgq |
| vulnerability_id |
VCID-q9et-6dxx-zbgq |
| summary |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.96 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.96 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-5nq8-gsav-5ffq |
|
| 14 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 15 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 16 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 17 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 18 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 19 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 20 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 21 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 22 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 23 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 24 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 25 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 26 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 27 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 28 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 29 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 30 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 31 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 32 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 33 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 34 |
| vulnerability |
VCID-mf9a-eusx-f3gb |
|
| 35 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 36 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 37 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 38 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 39 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 40 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 41 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 42 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 43 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 44 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 45 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 46 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 47 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 48 |
| vulnerability |
VCID-xn1n-5rgc-83bg |
|
| 49 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 50 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 51 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.96 |
|
|
| aliases |
CVE-2023-47797, GHSA-v32m-pf9q-p3xg
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q9et-6dxx-zbgq |
|
| 38 |
| url |
VCID-qy5u-7m7g-4ben |
| vulnerability_id |
VCID-qy5u-7m7g-4ben |
| summary |
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget
Cross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43823, GHSA-xx7h-2wf7-hc7p
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qy5u-7m7g-4ben |
|
| 39 |
| url |
VCID-r363-kggk-k3ds |
| vulnerability_id |
VCID-r363-kggk-k3ds |
| summary |
Liferay Portal is vulnerable to XSS in the Blogs widget
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.
The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-62265, GHSA-56jv-4ww3-65mw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r363-kggk-k3ds |
|
| 40 |
| url |
VCID-rns1-e6pd-tkex |
| vulnerability_id |
VCID-rns1-e6pd-tkex |
| summary |
Liferay Portal Vulnerable to XSS in Web Content translation
Stored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 2 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 3 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 4 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 5 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 6 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 7 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 8 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 9 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 10 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 11 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 12 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 13 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 14 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 15 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 16 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 17 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 18 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 19 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 20 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 21 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 22 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120 |
|
|
| aliases |
CVE-2025-43826, GHSA-qh92-cr5f-3595
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rns1-e6pd-tkex |
|
| 41 |
| url |
VCID-rs2y-3c75-uycm |
| vulnerability_id |
VCID-rs2y-3c75-uycm |
| summary |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2024-26271, GHSA-6c4v-x9v2-rjm8
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rs2y-3c75-uycm |
|
| 42 |
| url |
VCID-s86p-ew9a-rkgt |
| vulnerability_id |
VCID-s86p-ew9a-rkgt |
| summary |
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43736, GHSA-cg99-m88x-422c
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s86p-ew9a-rkgt |
|
| 43 |
| url |
VCID-su57-hncy-5qg4 |
| vulnerability_id |
VCID-su57-hncy-5qg4 |
| summary |
Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43817, GHSA-m4hg-46pw-6mmv
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-su57-hncy-5qg4 |
|
| 44 |
| url |
VCID-sw28-urg9-tqgd |
| vulnerability_id |
VCID-sw28-urg9-tqgd |
| summary |
Liferay Portal and Liferay DXP Reveals Data via Forms
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-2565, GHSA-9fcg-wrp8-qhr4
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sw28-urg9-tqgd |
|
| 45 |
| url |
VCID-tf5n-etq9-2bg1 |
| vulnerability_id |
VCID-tf5n-etq9-2bg1 |
| summary |
Liferay Portal Does Not Limit Access to APIs Before Email Verification
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62259, GHSA-gv7w-jh8g-vr73
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tf5n-etq9-2bg1 |
|
| 46 |
| url |
VCID-turp-jxv8-1fgy |
| vulnerability_id |
VCID-turp-jxv8-1fgy |
| summary |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 23 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 24 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 25 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 26 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 27 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 28 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 29 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 30 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 31 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 32 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 33 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 34 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 35 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 36 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 37 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 38 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 39 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 40 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 41 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 42 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103 |
|
|
| aliases |
CVE-2024-8980, GHSA-chj2-4vg7-hhg3
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-turp-jxv8-1fgy |
|
| 47 |
| url |
VCID-w7z4-h1ug-z3cq |
| vulnerability_id |
VCID-w7z4-h1ug-z3cq |
| summary |
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/liferay/liferay-portal |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.8 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
|
| 1 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/liferay/liferay-portal |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-43757, GHSA-62pf-hcwj-rcfc
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w7z4-h1ug-z3cq |
|
| 48 |
| url |
VCID-wpqk-8fd9-p3ex |
| vulnerability_id |
VCID-wpqk-8fd9-p3ex |
| summary |
Liferay Portal Unauthenticated File Access via URL
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43749, GHSA-5fx5-cff6-f3fp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wpqk-8fd9-p3ex |
|
| 49 |
| url |
VCID-xn1n-5rgc-83bg |
| vulnerability_id |
VCID-xn1n-5rgc-83bg |
| summary |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-292m-hgvs-93ey |
|
| 4 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 5 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 6 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 7 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 8 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 9 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 10 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 11 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 12 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 13 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 14 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 15 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 16 |
| vulnerability |
VCID-b24q-c9nx-hkdy |
|
| 17 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 18 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 19 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 20 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 21 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 22 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 23 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 24 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 25 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 26 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 27 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 28 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 29 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 30 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 31 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 32 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 33 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 34 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 35 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 36 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 37 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 38 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 39 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 40 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 41 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 42 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 43 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 44 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 45 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 46 |
| vulnerability |
VCID-xv4h-g41b-c7c7 |
|
| 47 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 48 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98 |
|
|
| aliases |
CVE-2023-42496, GHSA-54pv-r62j-9qqc
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xn1n-5rgc-83bg |
|
| 50 |
| url |
VCID-xv4h-g41b-c7c7 |
| vulnerability_id |
VCID-xv4h-g41b-c7c7 |
| summary |
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-3hm3-htje-akgd |
|
| 7 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 8 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 9 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 10 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 11 |
| vulnerability |
VCID-5bex-xcub-3qhr |
|
| 12 |
| vulnerability |
VCID-68yp-31d3-zbay |
|
| 13 |
| vulnerability |
VCID-6yrk-8tj5-juhp |
|
| 14 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 15 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 16 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 17 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 18 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 19 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 20 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 21 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 22 |
| vulnerability |
VCID-ej5y-geq1-pkfn |
|
| 23 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 24 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 25 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 26 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 27 |
| vulnerability |
VCID-hvpx-y297-sbha |
|
| 28 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 29 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 30 |
| vulnerability |
VCID-mbd8-z3ry-cqap |
|
| 31 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 32 |
| vulnerability |
VCID-pf71-p73a-xyda |
|
| 33 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 34 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 35 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 36 |
| vulnerability |
VCID-rs2y-3c75-uycm |
|
| 37 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 38 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 39 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 40 |
| vulnerability |
VCID-tf5n-etq9-2bg1 |
|
| 41 |
| vulnerability |
VCID-turp-jxv8-1fgy |
|
| 42 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 43 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 44 |
| vulnerability |
VCID-y1wd-arvg-2ugt |
|
| 45 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100 |
|
|
| aliases |
CVE-2024-26270, GHSA-xq4r-4xfh-vch8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xv4h-g41b-c7c7 |
|
| 51 |
| url |
VCID-y1wd-arvg-2ugt |
| vulnerability_id |
VCID-y1wd-arvg-2ugt |
| summary |
Liferay Portal is vulnerable to DNS rebinding attacks
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain. |
| references |
|
| fixed_packages |
| 0 |
|
| 1 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-11qf-d5xp-4fey |
|
| 1 |
| vulnerability |
VCID-1jgz-k7zp-uydp |
|
| 2 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 3 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 4 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 5 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 6 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 7 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 8 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 9 |
| vulnerability |
VCID-5732-ffyz-9fh5 |
|
| 10 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 11 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 12 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 13 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 14 |
| vulnerability |
VCID-ce9p-rwsz-zkf6 |
|
| 15 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 16 |
| vulnerability |
VCID-d56y-s4zt-uyd7 |
|
| 17 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 18 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 19 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 20 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 21 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 22 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 23 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 24 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 25 |
| vulnerability |
VCID-qy5u-7m7g-4ben |
|
| 26 |
| vulnerability |
VCID-r363-kggk-k3ds |
|
| 27 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 28 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 29 |
| vulnerability |
VCID-su57-hncy-5qg4 |
|
| 30 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 31 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 32 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
| 33 |
| vulnerability |
VCID-ynk1-3fye-bfcx |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112 |
|
|
| aliases |
CVE-2025-62266, GHSA-f5vh-4rj2-w8r8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y1wd-arvg-2ugt |
|
| 52 |
| url |
VCID-ynk1-3fye-bfcx |
| vulnerability_id |
VCID-ynk1-3fye-bfcx |
| summary |
Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page
Multiple stored Cross-site Scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| purl |
pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-27a1-teqk-cbe2 |
|
| 1 |
| vulnerability |
VCID-2bcr-bxek-skfq |
|
| 2 |
| vulnerability |
VCID-2dra-x6f5-xybz |
|
| 3 |
| vulnerability |
VCID-2mtb-mdha-qufv |
|
| 4 |
| vulnerability |
VCID-434b-p73k-5fam |
|
| 5 |
| vulnerability |
VCID-4kym-jhtn-cfa3 |
|
| 6 |
| vulnerability |
VCID-4xqq-69ab-1qew |
|
| 7 |
| vulnerability |
VCID-8xx2-vtnr-dubu |
|
| 8 |
| vulnerability |
VCID-brjh-tyur-ebc8 |
|
| 9 |
| vulnerability |
VCID-by7b-2zr9-y3dj |
|
| 10 |
| vulnerability |
VCID-ca62-h2qv-v7bg |
|
| 11 |
| vulnerability |
VCID-csnj-331s-43ea |
|
| 12 |
| vulnerability |
VCID-ebzh-bpks-5qe2 |
|
| 13 |
| vulnerability |
VCID-evap-nt9g-akf6 |
|
| 14 |
| vulnerability |
VCID-g41m-xvk2-xfda |
|
| 15 |
| vulnerability |
VCID-ggmh-6ef8-7ufj |
|
| 16 |
| vulnerability |
VCID-gyge-7d5c-6uhz |
|
| 17 |
| vulnerability |
VCID-j3pc-gwg6-qfbs |
|
| 18 |
| vulnerability |
VCID-ksvn-b6hv-hfa7 |
|
| 19 |
| vulnerability |
VCID-nhp5-61h7-ryf4 |
|
| 20 |
| vulnerability |
VCID-rns1-e6pd-tkex |
|
| 21 |
| vulnerability |
VCID-s86p-ew9a-rkgt |
|
| 22 |
| vulnerability |
VCID-sw28-urg9-tqgd |
|
| 23 |
| vulnerability |
VCID-w7z4-h1ug-z3cq |
|
| 24 |
| vulnerability |
VCID-wpqk-8fd9-p3ex |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112 |
|
|
| aliases |
CVE-2025-43822, GHSA-4mqx-4p8g-995w
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ynk1-3fye-bfcx |
|
|
|---|