Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/72990?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/72990?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.1", "type": "maven", "namespace": "com.liferay.portal", "name": "release.portal.bom", "version": "7.4.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9453?format=api", "vulnerability_id": "VCID-18rc-sf32-2uf1", "summary": "Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page\nCross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-37940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38717", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-37940" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:41:20Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940" }, { "reference_url": "https://github.com/advisories/GHSA-px38-239g-x5mg", "reference_id": "GHSA-px38-239g-x5mg", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-px38-239g-x5mg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23769?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-6nyv-mrte-8qgg" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-p9sb-sh56-pker" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.88" } ], "aliases": [ "CVE-2023-37940", "GHSA-px38-239g-x5mg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-18rc-sf32-2uf1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10221?format=api", "vulnerability_id": "VCID-2f2r-qffz-mfgz", "summary": "Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing\nThe Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25151", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00426", "scoring_system": "epss", "scoring_elements": "0.62519", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25151" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T19:59:16Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25151", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25151" }, { "reference_url": "https://github.com/advisories/GHSA-hgr6-6hhw-883f", "reference_id": "GHSA-hgr6-6hhw-883f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hgr6-6hhw-883f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26458?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4" } ], "aliases": [ "CVE-2024-25151", "GHSA-hgr6-6hhw-883f" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2f2r-qffz-mfgz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10088?format=api", "vulnerability_id": "VCID-2mj1-ag1g-cua8", "summary": "Privilege escalation in Liferay Portal\nLiferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-45320", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00362", "scoring_system": "epss", "scoring_elements": "0.5853", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-45320" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/releases/tag/7.4.3.16-ga16", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/releases/tag/7.4.3.16-ga16" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T15:24:47Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45320", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45320" }, { "reference_url": "https://github.com/advisories/GHSA-mc8m-4r3w-q2hw", "reference_id": "GHSA-mc8m-4r3w-q2hw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mc8m-4r3w-q2hw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25848?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16" } ], "aliases": [ "CVE-2022-45320", "GHSA-mc8m-4r3w-q2hw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2mj1-ag1g-cua8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10387?format=api", "vulnerability_id": "VCID-33gp-mfve-tfep", "summary": "Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)\nIn Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25610", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00106", "scoring_system": "epss", "scoring_elements": "0.28382", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25610" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-28T13:32:33Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25610", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25610" }, { "reference_url": "https://github.com/advisories/GHSA-vvpf-53qx-cxhh", "reference_id": "GHSA-vvpf-53qx-cxhh", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vvpf-53qx-cxhh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26757?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13" } ], "aliases": [ "CVE-2024-25610", "GHSA-vvpf-53qx-cxhh" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-33gp-mfve-tfep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10170?format=api", "vulnerability_id": "VCID-36t8-hged-ekdu", "summary": "Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting\nStored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25602", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00471", "scoring_system": "epss", "scoring_elements": "0.64903", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25602" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:23:34Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25602", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25602" }, { "reference_url": "https://github.com/advisories/GHSA-v2xq-m22w-jmpr", "reference_id": "GHSA-v2xq-m22w-jmpr", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v2xq-m22w-jmpr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/573950?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1" } ], "aliases": [ "CVE-2024-25602", "GHSA-v2xq-m22w-jmpr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-36t8-hged-ekdu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10681?format=api", "vulnerability_id": "VCID-3c5w-ggtq-cqe7", "summary": "Liferay Portal vulnerable to Denial of Service\nThe Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26265", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00688", "scoring_system": "epss", "scoring_elements": "0.72056", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26265" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265", "reference_id": "", "reference_type": "", "scores": [ { "value": "5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L" }, { "value": "5.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T19:41:28Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26265", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26265" }, { "reference_url": "https://github.com/advisories/GHSA-29xx-fhff-36m7", "reference_id": "GHSA-29xx-fhff-36m7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-29xx-fhff-36m7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25848?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.16" } ], "aliases": [ "CVE-2024-26265", "GHSA-29xx-fhff-36m7" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3c5w-ggtq-cqe7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10478?format=api", "vulnerability_id": "VCID-3f6j-kwvs-6ugd", "summary": "Liferay Portal and Liferay DXP HTTP Header Can Expose Versions\nIn Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26267", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00224", "scoring_system": "epss", "scoring_elements": "0.45122", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26267" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:20:52Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26267", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26267" }, { "reference_url": "https://github.com/advisories/GHSA-2mvj-q2q3-wxjv", "reference_id": "GHSA-2mvj-q2q3-wxjv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2mvj-q2q3-wxjv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27045?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.26-ga26" }, { "url": "http://public2.vulnerablecode.io/api/packages/26528?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27" } ], "aliases": [ "CVE-2024-26267", "GHSA-2mvj-q2q3-wxjv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3f6j-kwvs-6ugd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39149?format=api", "vulnerability_id": "VCID-3mnz-y1dd-jbbw", "summary": "SQL injection in Liferay Portal\nSQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33945", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00651", "scoring_system": "epss", "scoring_elements": "0.7119", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33945" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:49:11Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33945", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33945" }, { "reference_url": "https://github.com/advisories/GHSA-g7vw-43xg-8m4h", "reference_id": "GHSA-g7vw-43xg-8m4h", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-g7vw-43xg-8m4h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72473?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.18" } ], "aliases": [ "CVE-2023-33945", "GHSA-g7vw-43xg-8m4h" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3mnz-y1dd-jbbw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51862?format=api", "vulnerability_id": "VCID-4jwq-krnu-4qar", "summary": "Missing permissions check in Liferay Portal\nThe Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42126", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00144", "scoring_system": "epss", "scoring_elements": "0.34472", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42126" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17593", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17593" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42126", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42126" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:31:00Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126" }, { "reference_url": "https://github.com/advisories/GHSA-642h-mx8q-47p2", "reference_id": "GHSA-642h-mx8q-47p2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-642h-mx8q-47p2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/573965?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.29" }, { "url": "http://public2.vulnerablecode.io/api/packages/88145?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-6nyv-mrte-8qgg" }, { "vulnerability": "VCID-6vkr-bshe-yqeg" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rvhj-mmu9-2bcv" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.48" } ], "aliases": [ "CVE-2022-42126", "GHSA-642h-mx8q-47p2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4jwq-krnu-4qar" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28819?format=api", "vulnerability_id": "VCID-5748-cgs5-93c8", "summary": "Liferay Portal Uses Default Password\nLiferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43799", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17408", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43799" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-15T20:40:56Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43799", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43799" }, { "reference_url": "https://github.com/advisories/GHSA-43xf-59vr-g4f2", "reference_id": "GHSA-43xf-59vr-g4f2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-43xf-59vr-g4f2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2025-43799", "GHSA-43xf-59vr-g4f2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5748-cgs5-93c8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52220?format=api", "vulnerability_id": "VCID-59hg-58e6-q3hq", "summary": "Incorrect Default Permissions in Liferay Portal\nThe Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42130", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00191", "scoring_system": "epss", "scoring_elements": "0.4077", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42130" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17447", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17447" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42130", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42130" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:26:36Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42130" }, { "reference_url": "https://github.com/advisories/GHSA-mxvq-cv4x-p3jw", "reference_id": "GHSA-mxvq-cv4x-p3jw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mxvq-cv4x-p3jw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2022-42130", "GHSA-mxvq-cv4x-p3jw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-59hg-58e6-q3hq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51810?format=api", "vulnerability_id": "VCID-5g5h-jjku-zufu", "summary": "Incorrect Default Permissions in Liferay Portal\nThe Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42128", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40187", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42128" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17595", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17595" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42128", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42128" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:26:08Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42128" }, { "reference_url": "https://github.com/advisories/GHSA-wgqm-qp44-cg6x", "reference_id": "GHSA-wgqm-qp44-cg6x", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wgqm-qp44-cg6x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2022-42128", "GHSA-wgqm-qp44-cg6x" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5g5h-jjku-zufu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10510?format=api", "vulnerability_id": "VCID-5pe7-5247-suab", "summary": "Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting\nCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25147", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00192", "scoring_system": "epss", "scoring_elements": "0.40903", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25147" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:15:43Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25147", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25147" }, { "reference_url": "https://github.com/advisories/GHSA-xpjg-7hx7-wgcx", "reference_id": "GHSA-xpjg-7hx7-wgcx", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xpjg-7hx7-wgcx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/573949?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-s9md-17hh-yfa3" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uk3w-ehxr-ybe7" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1-1" } ], "aliases": [ "CVE-2024-25147", "GHSA-xpjg-7hx7-wgcx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5pe7-5247-suab" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51908?format=api", "vulnerability_id": "VCID-5skb-shqz-5ff2", "summary": "Path Traversal in Liferay Portal\nA Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42123", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.6207", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42123" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17518", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17518" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42123", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42123" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:56:31Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42123" }, { "reference_url": "https://github.com/advisories/GHSA-hffx-r282-w2g9", "reference_id": "GHSA-hffx-r282-w2g9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hffx-r282-w2g9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/88234?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19" } ], "aliases": [ "CVE-2022-42123", "GHSA-hffx-r282-w2g9" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5skb-shqz-5ff2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31032?format=api", "vulnerability_id": "VCID-68u4-q6vh-uqda", "summary": "Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43746", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12687", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43746" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5ca8331da4503ae336818a747e43817066f27b73" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7ac0f245435a18e42291186907ad6dbf0e4e8a43" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c4c34a13094356160474c06c3a115723d97f75ab" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18244", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18244" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T18:53:24Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43746", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43746" }, { "reference_url": "https://github.com/advisories/GHSA-mpww-r37c-vxjw", "reference_id": "GHSA-mpww-r37c-vxjw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mpww-r37c-vxjw" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43746", "GHSA-mpww-r37c-vxjw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-68u4-q6vh-uqda" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/28672?format=api", "vulnerability_id": "VCID-6e8x-qeby-u3d1", "summary": "Liferay Cross-site Scripting vulnerability\nA stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-3760", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0009", "scoring_system": "epss", "scoring_elements": "0.25587", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-3760" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-17T13:22:03Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3760", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3760" }, { "reference_url": "https://github.com/advisories/GHSA-qhp6-vp7c-g7xp", "reference_id": "GHSA-qhp6-vp7c-g7xp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qhp6-vp7c-g7xp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62100?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gu3f-jgwd-suez" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132" } ], "aliases": [ "CVE-2025-3760", "GHSA-qhp6-vp7c-g7xp" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6e8x-qeby-u3d1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10293?format=api", "vulnerability_id": "VCID-7jy4-y541-y7cy", "summary": "Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting\nCross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26269", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00192", "scoring_system": "epss", "scoring_elements": "0.40903", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26269" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T16:16:54Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26269", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26269" }, { "reference_url": "https://github.com/advisories/GHSA-rwhv-hvj2-qrqm", "reference_id": "GHSA-rwhv-hvj2-qrqm", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rwhv-hvj2-qrqm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26625?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.38" } ], "aliases": [ "CVE-2024-26269", "GHSA-rwhv-hvj2-qrqm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7jy4-y541-y7cy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7934?format=api", "vulnerability_id": "VCID-7yxf-sput-g7eb", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor\nCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26273", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02006", "scoring_system": "epss", "scoring_elements": "0.83973", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26273" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:18:21Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26273", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26273" }, { "reference_url": "https://github.com/advisories/GHSA-hmrx-6pr5-hpwj", "reference_id": "GHSA-hmrx-6pr5-hpwj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hmrx-6pr5-hpwj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20151?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.104" } ], "aliases": [ "CVE-2024-26273", "GHSA-hmrx-6pr5-hpwj" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7yxf-sput-g7eb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31752?format=api", "vulnerability_id": "VCID-814s-t8yb-7bhw", "summary": "Liferay Portal and Liferay DXP Reveals Data via Forms\nThe data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-2565", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00356", "scoring_system": "epss", "scoring_elements": "0.58114", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-2565" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T17:53:33Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2565", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2565" }, { "reference_url": "https://github.com/advisories/GHSA-9fcg-wrp8-qhr4", "reference_id": "GHSA-9fcg-wrp8-qhr4", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9fcg-wrp8-qhr4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62451?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gu3f-jgwd-suez" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.129" } ], "aliases": [ "CVE-2025-2565", "GHSA-9fcg-wrp8-qhr4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-814s-t8yb-7bhw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27729?format=api", "vulnerability_id": "VCID-8a6x-92ay-jugc", "summary": "Liferay Portal Does Not Limit Access to APIs Before Email Verification\nLiferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62259", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.18878", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62259" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T19:47:44Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62259", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62259" }, { "reference_url": "https://github.com/advisories/GHSA-gv7w-jh8g-vr73", "reference_id": "GHSA-gv7w-jh8g-vr73", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gv7w-jh8g-vr73" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61433?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110" }, { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2025-62259", "GHSA-gv7w-jh8g-vr73" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8a6x-92ay-jugc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27549?format=api", "vulnerability_id": "VCID-8fv2-ugm3-qfh3", "summary": "Liferay Portal is vulnerable to XSS in the Blogs widget\nCross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's “Content” text field.\n\nThe Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62265", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00032", "scoring_system": "epss", "scoring_elements": "0.09794", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62265" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:04:40Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62265" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62265", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62265" }, { "reference_url": "https://github.com/advisories/GHSA-56jv-4ww3-65mw", "reference_id": "GHSA-56jv-4ww3-65mw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-56jv-4ww3-65mw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20413?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112" } ], "aliases": [ "CVE-2025-62265", "GHSA-56jv-4ww3-65mw" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8fv2-ugm3-qfh3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27777?format=api", "vulnerability_id": "VCID-8xj7-x2xq-9beg", "summary": "Liferay Portal vulnerable to password enumeration\nPassword enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62257", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04548", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62257" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45cffd5030ab78e8b005d9cfd6284311da978c68" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/924a0a47007665693fe2d29623cb48a426a80266" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d21627ac07561c5063f611be631e63ff502ec8e7" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17692", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17692" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T14:08:10Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62257", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62257" }, { "reference_url": "https://github.com/advisories/GHSA-8hw3-ghwv-crfh", "reference_id": "GHSA-8hw3-ghwv-crfh", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8hw3-ghwv-crfh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61454?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120" } ], "aliases": [ "CVE-2025-62257", "GHSA-8hw3-ghwv-crfh" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8xj7-x2xq-9beg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27723?format=api", "vulnerability_id": "VCID-98s7-bcmu-tkaw", "summary": "Liferay Portal is vulnerable to DNS rebinding attacks\nBy default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62266", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00045", "scoring_system": "epss", "scoring_elements": "0.14328", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62266" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-30T19:06:36Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62266", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62266" }, { "reference_url": "https://github.com/advisories/GHSA-f5vh-4rj2-w8r8", "reference_id": "GHSA-f5vh-4rj2-w8r8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f5vh-4rj2-w8r8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61433?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.110" }, { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2025-62266", "GHSA-f5vh-4rj2-w8r8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-98s7-bcmu-tkaw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31031?format=api", "vulnerability_id": "VCID-9sb7-qrgp-1yf9", "summary": "Liferay Portal CSRF Vulnerability via Endpoint Parameter\nA CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43745", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00036", "scoring_system": "epss", "scoring_elements": "0.11101", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43745" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/037b58f96c9ded47960ab493a68d68aaf32b1a43" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/2387ee78fd471ea1c1c4d696aa0cbb1bce72665e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/729dfc202c9d2724b5f3f749ead14eb13832e101" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18275", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18275" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:15:28Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43745" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43745", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43745" }, { "reference_url": "https://github.com/advisories/GHSA-7q33-gwcm-r6cj", "reference_id": "GHSA-7q33-gwcm-r6cj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7q33-gwcm-r6cj" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43745", "GHSA-7q33-gwcm-r6cj" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9sb7-qrgp-1yf9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31293?format=api", "vulnerability_id": "VCID-a3ry-pezq-9bg9", "summary": "Liferay Portal Unauthenticated File Access via URL\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43749", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0013", "scoring_system": "epss", "scoring_elements": "0.32074", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43749" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5919534a979a97444172f49705b7a224e372e625" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b88e7e0912d27cc166fc788b642616ece9e8c484" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18176", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18176" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:12:36Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43749", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43749" }, { "reference_url": "https://github.com/advisories/GHSA-5fx5-cff6-f3fp", "reference_id": "GHSA-5fx5-cff6-f3fp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5fx5-cff6-f3fp" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43749", "GHSA-5fx5-cff6-f3fp" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a3ry-pezq-9bg9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27551?format=api", "vulnerability_id": "VCID-aykp-anzz-3ueg", "summary": "Liferay Profile Widget does not prevent vCard extension spoofing\nThe Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43824", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00033", "scoring_system": "epss", "scoring_elements": "0.10205", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43824" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-07T15:52:30Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43824" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43824", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43824" }, { "reference_url": "https://github.com/advisories/GHSA-pfxj-gvqg-mj44", "reference_id": "GHSA-pfxj-gvqg-mj44", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pfxj-gvqg-mj44" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20413?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112" } ], "aliases": [ "CVE-2025-43824", "GHSA-pfxj-gvqg-mj44" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-aykp-anzz-3ueg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8137?format=api", "vulnerability_id": "VCID-b82g-xw43-rkhz", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor\nCross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26272", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.06126", "scoring_system": "epss", "scoring_elements": "0.90929", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26272" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:15:06Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26272", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26272" }, { "reference_url": "https://github.com/advisories/GHSA-p63m-vmjr-wg37", "reference_id": "GHSA-p63m-vmjr-wg37", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-p63m-vmjr-wg37" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20340?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108" }, { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2024-26272", "GHSA-p63m-vmjr-wg37" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-b82g-xw43-rkhz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27670?format=api", "vulnerability_id": "VCID-bzej-3ua8-4yaj", "summary": "Liferay Portal is vulnerable to XSS through its Commerce Search Result widget\nCross-site Scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6, 2023.Q3 before patch 9, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Commerce Product's Name text field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43823", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09323", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43823" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:40:14Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43823" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43823", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43823" }, { "reference_url": "https://github.com/advisories/GHSA-xx7h-2wf7-hc7p", "reference_id": "GHSA-xx7h-2wf7-hc7p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xx7h-2wf7-hc7p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20413?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112" } ], "aliases": [ "CVE-2025-43823", "GHSA-xx7h-2wf7-hc7p" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bzej-3ua8-4yaj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10185?format=api", "vulnerability_id": "VCID-c86c-e9ym-jud2", "summary": "Liferay Portal and Liferay DXP User Enumeration Vulnerability\nUser enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26268", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.53927", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26268" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:11Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26268", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26268" }, { "reference_url": "https://github.com/advisories/GHSA-qm43-g2xj-hvg5", "reference_id": "GHSA-qm43-g2xj-hvg5", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qm43-g2xj-hvg5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26357?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27-ga27" }, { "url": "http://public2.vulnerablecode.io/api/packages/325367?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.28" } ], "aliases": [ "CVE-2024-26268", "GHSA-qm43-g2xj-hvg5" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c86c-e9ym-jud2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30931?format=api", "vulnerability_id": "VCID-cbt7-tube-jkgz", "summary": "Liferay Portal Enumeration Discrepancy in Calendars\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43743", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.23888", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43743" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18206", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18206" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-19T19:28:02Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43743", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43743" }, { "reference_url": "https://github.com/advisories/GHSA-g4vp-4gqr-7v8c", "reference_id": "GHSA-g4vp-4gqr-7v8c", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-g4vp-4gqr-7v8c" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43743", "GHSA-g4vp-4gqr-7v8c" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cbt7-tube-jkgz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48860?format=api", "vulnerability_id": "VCID-da1k-nezs-xfh8", "summary": "Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled\nAn insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-41414", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00206", "scoring_system": "epss", "scoring_elements": "0.42658", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-41414" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/659c4422bd32b1db1a01a7f4a42b7702d512ffa2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/659c4422bd32b1db1a01a7f4a42b7702d512ffa2" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-01-insecure-defaults-auth-login-prompt-enabled?p_r_p_assetEntryId=121612026&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612026%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-01-insecure-defaults-auth-login-prompt-enabled?p_r_p_assetEntryId=121612026&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612026%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41414", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41414" }, { "reference_url": "https://github.com/advisories/GHSA-9427-7f65-88c8", "reference_id": "GHSA-9427-7f65-88c8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9427-7f65-88c8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27457?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3" }, { "url": "http://public2.vulnerablecode.io/api/packages/573950?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1" } ], "aliases": [ "CVE-2022-41414", "GHSA-9427-7f65-88c8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-da1k-nezs-xfh8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10346?format=api", "vulnerability_id": "VCID-dah3-w7pd-43cp", "summary": "Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions\nLiferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25604", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25364", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25604" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:38:45Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25604", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25604" }, { "reference_url": "https://github.com/advisories/GHSA-pw7p-3648-qqmg", "reference_id": "GHSA-pw7p-3648-qqmg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pw7p-3648-qqmg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26740?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5" }, { "url": "http://public2.vulnerablecode.io/api/packages/573951?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6" } ], "aliases": [ "CVE-2024-25604", "GHSA-pw7p-3648-qqmg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dah3-w7pd-43cp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30990?format=api", "vulnerability_id": "VCID-daxj-5xz8-d3g3", "summary": "Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43735", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0007", "scoring_system": "epss", "scoring_elements": "0.21593", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43735" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18158", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18158" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-12T13:31:05Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43735", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43735" }, { "reference_url": "https://github.com/advisories/GHSA-222w-xmc5-jhp3", "reference_id": "GHSA-222w-xmc5-jhp3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-222w-xmc5-jhp3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62100?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gu3f-jgwd-suez" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.132" } ], "aliases": [ "CVE-2025-43735", "GHSA-222w-xmc5-jhp3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-daxj-5xz8-d3g3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/29014?format=api", "vulnerability_id": "VCID-dnv6-swpp-cuee", "summary": "Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting\nA stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43776", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.13934", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43776" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18277", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18277" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-09-09T15:04:48Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43776" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43776", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43776" }, { "reference_url": "https://github.com/advisories/GHSA-rcc7-jx7p-hrv4", "reference_id": "GHSA-rcc7-jx7p-hrv4", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-rcc7-jx7p-hrv4" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43776", "GHSA-rcc7-jx7p-hrv4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dnv6-swpp-cuee" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10440?format=api", "vulnerability_id": "VCID-ejsh-acyx-2bda", "summary": "Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character\nHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25608", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1765", "scoring_system": "epss", "scoring_elements": "0.95213", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25608" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:50:15Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25608", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25608" }, { "reference_url": "https://github.com/advisories/GHSA-548x-j6x6-hcv4", "reference_id": "GHSA-548x-j6x6-hcv4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-548x-j6x6-hcv4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26813?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19-ga19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.19-ga19" }, { "url": "http://public2.vulnerablecode.io/api/packages/573957?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.20" } ], "aliases": [ "CVE-2024-25608", "GHSA-548x-j6x6-hcv4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ejsh-acyx-2bda" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10368?format=api", "vulnerability_id": "VCID-er8v-jdqz-4fbw", "summary": "Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting\nReflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-42496", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0044", "scoring_system": "epss", "scoring_elements": "0.63472", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-42496" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T16:07:22Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42496", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42496" }, { "reference_url": "https://github.com/advisories/GHSA-54pv-r62j-9qqc", "reference_id": "GHSA-54pv-r62j-9qqc", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-54pv-r62j-9qqc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25943?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-p9sb-sh56-pker" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.98" } ], "aliases": [ "CVE-2023-42496", "GHSA-54pv-r62j-9qqc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-er8v-jdqz-4fbw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31026?format=api", "vulnerability_id": "VCID-erjj-fcds-2ydh", "summary": "Liferay Portal Vulnerable to Cross-Site Scripting\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43731", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.15328", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43731" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18217", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18217" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18219", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18219" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-18T18:37:36Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43731", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43731" }, { "reference_url": "https://github.com/advisories/GHSA-3p2m-574v-v257", "reference_id": "GHSA-3p2m-574v-v257", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-3p2m-574v-v257" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43731", "GHSA-3p2m-574v-v257" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-erjj-fcds-2ydh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31411?format=api", "vulnerability_id": "VCID-fbkn-d96m-gyas", "summary": "Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43734", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.15328", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43734" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18234", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18234" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-12T19:00:01Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43734", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43734" }, { "reference_url": "https://github.com/advisories/GHSA-m5c7-5gv3-hcpf", "reference_id": "GHSA-m5c7-5gv3-hcpf", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-m5c7-5gv3-hcpf" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43734", "GHSA-m5c7-5gv3-hcpf" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fbkn-d96m-gyas" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49406?format=api", "vulnerability_id": "VCID-fd71-whkv-17hz", "summary": "Liferay Portal Missing Authorization vulnerability\nThe Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a \"Content Page\" type page, allowing attackers to view unpublished \"Content Page\" pages via URL manipulation.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-39975", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00157", "scoring_system": "epss", "scoring_elements": "0.36276", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-39975" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39975", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39975" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:55:52Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975" }, { "reference_url": "https://github.com/advisories/GHSA-83qx-288m-72w4", "reference_id": "GHSA-83qx-288m-72w4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-83qx-288m-72w4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85355?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.35" } ], "aliases": [ "CVE-2022-39975", "GHSA-83qx-288m-72w4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fd71-whkv-17hz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27541?format=api", "vulnerability_id": "VCID-gnwg-4bcp-2fep", "summary": "Liferay Portal is vulnerable to Stored XSS through Forms text type field\nStored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43830", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09397", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43830" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-08T13:36:35Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43830" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43830", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43830" }, { "reference_url": "https://github.com/advisories/GHSA-378f-8q54-3fqx", "reference_id": "GHSA-378f-8q54-3fqx", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-378f-8q54-3fqx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20413?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112" } ], "aliases": [ "CVE-2025-43830", "GHSA-378f-8q54-3fqx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gnwg-4bcp-2fep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30958?format=api", "vulnerability_id": "VCID-gv9f-cur9-2be3", "summary": "Liferay Portal's Unlimited File Upload Could Result in DoS\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the object entries attachment fields, the files are stored in the document_library allowing an attacker to cause a potential DDoS.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43752", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.28988", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43752" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45dda30252d83912307491d8ed8802577871fa25" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f3e4723acdf15d3f690d401d6eb6a5653e5be391" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/fffed67b3fd1cc6071fd25a9b104b7691ffea2f8" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18188", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18188" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T11:27:55Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43752" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43752", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43752" }, { "reference_url": "https://github.com/advisories/GHSA-qpp6-f3qj-rggq", "reference_id": "GHSA-qpp6-f3qj-rggq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qpp6-f3qj-rggq" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43752", "GHSA-qpp6-f3qj-rggq" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gv9f-cur9-2be3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/49334?format=api", "vulnerability_id": "VCID-h4n5-jx1f-1bhj", "summary": "Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented\nHtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T16:00:44Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28977", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0051", "scoring_system": "epss", "scoring_elements": "0.66709", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28977" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/242e8bcabe3e8767799d3d1e6c021a75b4ada11b" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/6389885476414d3cd9e3092b4708906a5bdc8a48" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/8aa3fd76f34d1a4562bd5b4f82931a0a124e31a8" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17327", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17327" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28977?p_r_p_assetEntryId=121612261&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612261%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28977", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28977" }, { "reference_url": "https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20220922060039/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash", "reference_id": "cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T16:00:44Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash" }, { "reference_url": "https://github.com/advisories/GHSA-w397-9p2j-6x23", "reference_id": "GHSA-w397-9p2j-6x23", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w397-9p2j-6x23" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27291?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ezuh-61ru-ubhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4" }, { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2022-28977", "GHSA-w397-9p2j-6x23" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h4n5-jx1f-1bhj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31272?format=api", "vulnerability_id": "VCID-hrcr-arpj-t7h1", "summary": "Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect", "references": [ { "reference_url": "http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43760", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00048", "scoring_system": "epss", "scoring_elements": "0.15328", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43760" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18156", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18156" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-22T18:00:22Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43760", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43760" }, { "reference_url": "https://github.com/advisories/GHSA-fvqv-593q-qp8r", "reference_id": "GHSA-fvqv-593q-qp8r", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fvqv-593q-qp8r" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43760", "GHSA-fvqv-593q-qp8r" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hrcr-arpj-t7h1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31198?format=api", "vulnerability_id": "VCID-ht7d-5a1n-vyap", "summary": "Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43757", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12687", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43757" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18259", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18259" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T20:00:20Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43757", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43757" }, { "reference_url": "https://github.com/advisories/GHSA-62pf-hcwj-rcfc", "reference_id": "GHSA-62pf-hcwj-rcfc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-62pf-hcwj-rcfc" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43757", "GHSA-62pf-hcwj-rcfc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ht7d-5a1n-vyap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7881?format=api", "vulnerability_id": "VCID-j1bu-gxq7-abcx", "summary": "Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console\nThe Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-8980", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00381", "scoring_system": "epss", "scoring_elements": "0.59798", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-8980" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:02:17Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8980", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8980" }, { "reference_url": "https://github.com/advisories/GHSA-chj2-4vg7-hhg3", "reference_id": "GHSA-chj2-4vg7-hhg3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-chj2-4vg7-hhg3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20071?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.102-GA102" }, { "url": "http://public2.vulnerablecode.io/api/packages/682184?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.103" } ], "aliases": [ "CVE-2024-8980", "GHSA-chj2-4vg7-hhg3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j1bu-gxq7-abcx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10260?format=api", "vulnerability_id": "VCID-j1sr-kz76-wuew", "summary": "Liferay Portal stored cross-site scripting (XSS) vulnerability\nStored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25145", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25145" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-08T17:02:17Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25145", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25145" }, { "reference_url": "https://github.com/advisories/GHSA-9vgq-w5pv-v77q", "reference_id": "GHSA-9vgq-w5pv-v77q", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9vgq-w5pv-v77q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26513?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.12" } ], "aliases": [ "CVE-2024-25145", "GHSA-9vgq-w5pv-v77q" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j1sr-kz76-wuew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31384?format=api", "vulnerability_id": "VCID-j4w5-6t6r-3fer", "summary": "Liferay Portal Username Enumeration Vulnerability\nUsername enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.", "references": [ { "reference_url": "http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43754", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00078", "scoring_system": "epss", "scoring_elements": "0.23324", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43754" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18149", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18149" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-21T20:01:22Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43754", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43754" }, { "reference_url": "https://github.com/advisories/GHSA-x7p4-v8mj-6fxx", "reference_id": "GHSA-x7p4-v8mj-6fxx", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-x7p4-v8mj-6fxx" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43754", "GHSA-x7p4-v8mj-6fxx" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j4w5-6t6r-3fer" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10547?format=api", "vulnerability_id": "VCID-j6nv-5sjy-ykdy", "summary": "Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel\nInformation disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25150", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00172", "scoring_system": "epss", "scoring_elements": "0.38399", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25150" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T14:56:08Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25150", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25150" }, { "reference_url": "https://github.com/advisories/GHSA-4585-28v2-8h46", "reference_id": "GHSA-4585-28v2-8h46", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4585-28v2-8h46" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27291?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ezuh-61ru-ubhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4-ga4" }, { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2024-25150", "GHSA-4585-28v2-8h46" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j6nv-5sjy-ykdy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31520?format=api", "vulnerability_id": "VCID-jhpw-jb9e-xqhj", "summary": "Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery\nLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-4581", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00064", "scoring_system": "epss", "scoring_elements": "0.20236", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-4581" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:25Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4581" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4581", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4581" }, { "reference_url": "https://github.com/advisories/GHSA-6v93-frf9-2rp8", "reference_id": "GHSA-6v93-frf9-2rp8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6v93-frf9-2rp8" } ], "fixed_packages": [], "aliases": [ "CVE-2025-4581", "GHSA-6v93-frf9-2rp8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jhpw-jb9e-xqhj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27286?format=api", "vulnerability_id": "VCID-jmxy-p9t5-ayau", "summary": "Liferay Portal Vulnerable to DoS via Crafted Headless API Request\nLiferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62260", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.38995", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62260" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17800", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17800" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T15:01:15Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62260", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62260" }, { "reference_url": "https://github.com/advisories/GHSA-vgqx-447m-wvcj", "reference_id": "GHSA-vgqx-447m-wvcj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vgqx-447m-wvcj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25608?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100" } ], "aliases": [ "CVE-2025-62260", "GHSA-vgqx-447m-wvcj" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jmxy-p9t5-ayau" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39264?format=api", "vulnerability_id": "VCID-kprn-p4ys-zyep", "summary": "Cross-site scripting in Liferay Portal\nCross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49467", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33940" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:34Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33940", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33940" }, { "reference_url": "https://github.com/advisories/GHSA-x82q-mr23-27jc", "reference_id": "GHSA-x82q-mr23-27jc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-x82q-mr23-27jc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/73050?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.31" } ], "aliases": [ "CVE-2023-33940", "GHSA-x82q-mr23-27jc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kprn-p4ys-zyep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31453?format=api", "vulnerability_id": "VCID-mwc1-h7hq-y3fg", "summary": "Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter\nA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43741", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.14034", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43741" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/264f4f91aa4f8373c5a9cc44420edf1689384cbb" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18193", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18193" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T15:16:53Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43741", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43741" }, { "reference_url": "https://github.com/advisories/GHSA-j6p8-g3rj-ghpm", "reference_id": "GHSA-j6p8-g3rj-ghpm", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-j6p8-g3rj-ghpm" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43741", "GHSA-j6p8-g3rj-ghpm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mwc1-h7hq-y3fg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10476?format=api", "vulnerability_id": "VCID-ngx4-7y39-63bf", "summary": "Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting\nStored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25603", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25603" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-08-15T15:56:27Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25603", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25603" }, { "reference_url": "https://github.com/advisories/GHSA-44jg-jgjx-3xg5", "reference_id": "GHSA-44jg-jgjx-3xg5", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-44jg-jgjx-3xg5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2024-25603", "GHSA-44jg-jgjx-3xg5" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ngx4-7y39-63bf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10532?format=api", "vulnerability_id": "VCID-nh3b-vkjh-y7ee", "summary": "Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting\nStored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25152", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25152" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-21T19:54:47Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25152", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25152" }, { "reference_url": "https://github.com/advisories/GHSA-p28x-4r5h-ph6j", "reference_id": "GHSA-p28x-4r5h-ph6j", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p28x-4r5h-ph6j" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/573950?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1" } ], "aliases": [ "CVE-2024-25152", "GHSA-p28x-4r5h-ph6j" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nh3b-vkjh-y7ee" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52146?format=api", "vulnerability_id": "VCID-nt12-fes6-xbez", "summary": "Inefficient Regular Expression Complexity in Liferay Portal\nReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42124", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01185", "scoring_system": "epss", "scoring_elements": "0.79094", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42124" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17435", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17435" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17535", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17535" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42124", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42124" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:49:41Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42124" }, { "reference_url": "https://github.com/advisories/GHSA-vjj4-qwcm-552h", "reference_id": "GHSA-vjj4-qwcm-552h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vjj4-qwcm-552h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2022-42124", "GHSA-vjj4-qwcm-552h" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nt12-fes6-xbez" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10531?format=api", "vulnerability_id": "VCID-nzn2-n9hz-67ea", "summary": "Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting\nMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26266", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26266" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T16:43:41Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26266", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26266" }, { "reference_url": "https://github.com/advisories/GHSA-rwxc-4cmw-7x75", "reference_id": "GHSA-rwxc-4cmw-7x75", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rwxc-4cmw-7x75" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27099?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14" } ], "aliases": [ "CVE-2024-26266", "GHSA-rwxc-4cmw-7x75" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nzn2-n9hz-67ea" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27948?format=api", "vulnerability_id": "VCID-p5ek-t5kg-k7d1", "summary": "Liferay Portal Vulnerable to CSRF in Headless APIs\nCSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62258", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00024", "scoring_system": "epss", "scoring_elements": "0.07326", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62258" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "7.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:59:44Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62258", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62258" }, { "reference_url": "https://github.com/advisories/GHSA-gh4w-8qgq-8w9r", "reference_id": "GHSA-gh4w-8qgq-8w9r", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gh4w-8qgq-8w9r" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20340?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108" }, { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2025-62258", "GHSA-gh4w-8qgq-8w9r" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p5ek-t5kg-k7d1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31433?format=api", "vulnerability_id": "VCID-pr4k-p1kc-gfdt", "summary": "Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels\nA stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43744", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00046", "scoring_system": "epss", "scoring_elements": "0.14609", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43744" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/3b36fadfe92437deab4a55029a1a369e046f3829" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c07a490b3d3759f38c5473cda74e99540bd0235e" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18271", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18271" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-20T14:14:31Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43744", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43744" }, { "reference_url": "https://github.com/advisories/GHSA-m49p-6cjp-x2h3", "reference_id": "GHSA-m49p-6cjp-x2h3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-m49p-6cjp-x2h3" } ], "fixed_packages": [], "aliases": [ "CVE-2025-43744", "GHSA-m49p-6cjp-x2h3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pr4k-p1kc-gfdt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10331?format=api", "vulnerability_id": "VCID-q8ay-yhsa-s7be", "summary": "Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting\nStored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25601", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25601" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T14:15:10Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25601", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25601" }, { "reference_url": "https://github.com/advisories/GHSA-cr36-3vqf-x5w5", "reference_id": "GHSA-cr36-3vqf-x5w5", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cr36-3vqf-x5w5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/573950?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1" } ], "aliases": [ "CVE-2024-25601", "GHSA-cr36-3vqf-x5w5" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q8ay-yhsa-s7be" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31434?format=api", "vulnerability_id": "VCID-q9n2-r73c-v3cg", "summary": "Liferay Portal Login Bypass Vulnerability\nLiferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-3639", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0004", "scoring_system": "epss", "scoring_elements": "0.12503", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-3639" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-18212", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-18212" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639", "reference_id": "", "reference_type": "", "scores": [ { "value": "2", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L" }, { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-18T19:51:41Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3639", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3639" }, { "reference_url": "https://github.com/advisories/GHSA-g4wg-mpfg-x2q6", "reference_id": "GHSA-g4wg-mpfg-x2q6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-g4wg-mpfg-x2q6" } ], "fixed_packages": [], "aliases": [ "CVE-2025-3639", "GHSA-g4wg-mpfg-x2q6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q9n2-r73c-v3cg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27630?format=api", "vulnerability_id": "VCID-r3y7-a2q2-9fcn", "summary": "Liferay Portal Vulnerable to XSS in Web Content translation\nStored Cross-site Scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43826", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.09323", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43826" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17939", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17939" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-01T15:03:14Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43826" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43826", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43826" }, { "reference_url": "https://github.com/advisories/GHSA-qh92-cr5f-3595", "reference_id": "GHSA-qh92-cr5f-3595", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qh92-cr5f-3595" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61338?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.113-ga113" }, { "url": "http://public2.vulnerablecode.io/api/packages/61454?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120" } ], "aliases": [ "CVE-2025-43826", "GHSA-qh92-cr5f-3595" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r3y7-a2q2-9fcn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31550?format=api", "vulnerability_id": "VCID-rrc5-43t6-yfb2", "summary": "Liferay Portal Vulnerable to Cross-Site Request Forgery\nInsufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows attackers to execute Cross-Site Request Forgery", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43748", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00033", "scoring_system": "epss", "scoring_elements": "0.10096", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43748" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17839", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17839" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-08-22T03:55:44Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43748" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43748", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43748" }, { "reference_url": "https://github.com/advisories/GHSA-p9gc-59hf-x48p", "reference_id": "GHSA-p9gc-59hf-x48p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-p9gc-59hf-x48p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/772382?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gu3f-jgwd-suez" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.125" }, { "url": "http://public2.vulnerablecode.io/api/packages/64667?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.120-ga120" } ], "aliases": [ "CVE-2025-43748", "GHSA-p9gc-59hf-x48p" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rrc5-43t6-yfb2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8255?format=api", "vulnerability_id": "VCID-rxpu-tuhm-e7ew", "summary": "Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions\nThe workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-38002", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04275", "scoring_system": "epss", "scoring_elements": "0.89011", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-38002" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002", "reference_id": "", "reference_type": "", "scores": [ { "value": "9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-22T15:21:03Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38002", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38002" }, { "reference_url": "https://github.com/advisories/GHSA-3mfq-fp2f-vwqh", "reference_id": "GHSA-3mfq-fp2f-vwqh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-3mfq-fp2f-vwqh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20413?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112-ga112" } ], "aliases": [ "CVE-2024-38002", "GHSA-3mfq-fp2f-vwqh" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rxpu-tuhm-e7ew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9470?format=api", "vulnerability_id": "VCID-rxws-w8x6-sua4", "summary": "Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting\nReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-11993", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38717", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-11993" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:24:48Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11993", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11993" }, { "reference_url": "https://github.com/advisories/GHSA-4hxr-28mv-q729", "reference_id": "GHSA-4hxr-28mv-q729", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-4hxr-28mv-q729" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23879?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.39" } ], "aliases": [ "CVE-2024-11993", "GHSA-4hxr-28mv-q729" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rxws-w8x6-sua4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10166?format=api", "vulnerability_id": "VCID-s9md-17hh-yfa3", "summary": "Liferay Portal allows attackers to discover the existence of sites\nLiferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25146", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00388", "scoring_system": "epss", "scoring_elements": "0.60136", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25146" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T15:42:08Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25146", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25146" }, { "reference_url": "https://github.com/advisories/GHSA-mqf8-4cqm-p83x", "reference_id": "GHSA-mqf8-4cqm-p83x", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mqf8-4cqm-p83x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26192?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2" } ], "aliases": [ "CVE-2024-25146", "GHSA-mqf8-4cqm-p83x" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s9md-17hh-yfa3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10224?format=api", "vulnerability_id": "VCID-sect-yjwh-1qew", "summary": "Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes\nHtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25609", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00261", "scoring_system": "epss", "scoring_elements": "0.49616", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25609" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/3c5ee2054b44e4354cd2e53782914157ef2b5362" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5c9655c941b18d8948a0c38b2bc84f4a1f83543a" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/66f3ae610c24f10a6950e75e0ca4c981935244ed" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/702a1e35896681f04ec3c7c8075aa87d5e16a18d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7aca15e7195a03243d5461fcf09cde0fa7de81f0" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/dca931af71a3d9fbd896a25b92396df8458d2886" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f015ad20bd9ee1661ccff5fb48e03dd3a1ebf003" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-23T19:18:48Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25609", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25609" }, { "reference_url": "https://github.com/advisories/GHSA-3qq5-wcrx-4h8r", "reference_id": "GHSA-3qq5-wcrx-4h8r", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3qq5-wcrx-4h8r" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26461?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13-ga13" }, { "url": "http://public2.vulnerablecode.io/api/packages/27099?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14" } ], "aliases": [ "CVE-2024-25609", "GHSA-3qq5-wcrx-4h8r" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sect-yjwh-1qew" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10365?format=api", "vulnerability_id": "VCID-ssys-9pqn-9kd7", "summary": "Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API\nThe Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25605", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40187", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25605" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:21:08Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25605", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25605" }, { "reference_url": "https://github.com/advisories/GHSA-mf8h-grfg-j9j3", "reference_id": "GHSA-mf8h-grfg-j9j3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mf8h-grfg-j9j3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26740?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5" }, { "url": "http://public2.vulnerablecode.io/api/packages/573951?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6" } ], "aliases": [ "CVE-2024-25605", "GHSA-mf8h-grfg-j9j3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ssys-9pqn-9kd7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/29006?format=api", "vulnerability_id": "VCID-tn86-egxy-1fcq", "summary": "Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet\nPossible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43813", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00181", "scoring_system": "epss", "scoring_elements": "0.39524", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-43813" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/7acad68976e831a0f3b855752ad7874e03be1d43" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9159075ede8a1656bf67a893a486c93a9e9fe70a" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9be57d358ae0f6181a138ce08f52b80e4b14778a" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17865", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17865" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-09-30T14:45:14Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43813", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43813" }, { "reference_url": "https://github.com/advisories/GHSA-2hm7-r8f3-423h", "reference_id": "GHSA-2hm7-r8f3-423h", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2hm7-r8f3-423h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62473?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.108-ga108" }, { "url": "http://public2.vulnerablecode.io/api/packages/20304?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.112" } ], "aliases": [ "CVE-2025-43813", "GHSA-2hm7-r8f3-423h" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tn86-egxy-1fcq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10299?format=api", "vulnerability_id": "VCID-uk3w-ehxr-ybe7", "summary": "Liferay Portal vulnerable to user impersonation\nIn Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25148", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00433", "scoring_system": "epss", "scoring_elements": "0.63043", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25148" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-21T17:33:36Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25148", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25148" }, { "reference_url": "https://github.com/advisories/GHSA-qwj8-qgpr-8crm", "reference_id": "GHSA-qwj8-qgpr-8crm", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qwj8-qgpr-8crm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26192?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2" } ], "aliases": [ "CVE-2024-25148", "GHSA-qwj8-qgpr-8crm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uk3w-ehxr-ybe7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10616?format=api", "vulnerability_id": "VCID-ur67-cmfj-mbas", "summary": "Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options\nLiferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25149", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49427", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25149" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T17:46:50Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25149", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25149" }, { "reference_url": "https://github.com/advisories/GHSA-qpgh-6v9w-vfv6", "reference_id": "GHSA-qpgh-6v9w-vfv6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qpgh-6v9w-vfv6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27457?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-ga3" }, { "url": "http://public2.vulnerablecode.io/api/packages/573950?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.2-1" } ], "aliases": [ "CVE-2024-25149", "GHSA-qpgh-6v9w-vfv6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ur67-cmfj-mbas" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39164?format=api", "vulnerability_id": "VCID-uwbr-2985-s7ed", "summary": "Cross-site scripting in Liferay Portal\nCross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33944", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00305", "scoring_system": "epss", "scoring_elements": "0.54028", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33944" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:15Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33944", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33944" }, { "reference_url": "https://github.com/advisories/GHSA-pfwc-4frf-4gf8", "reference_id": "GHSA-pfwc-4frf-4gf8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pfwc-4frf-4gf8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72507?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-6nyv-mrte-8qgg" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rvhj-mmu9-2bcv" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.69" } ], "aliases": [ "CVE-2023-33944", "GHSA-pfwc-4frf-4gf8" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uwbr-2985-s7ed" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52135?format=api", "vulnerability_id": "VCID-vxds-7hfx-kkdq", "summary": "Improper Certificate Validation in Liferay Portal\nCertain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42131", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0013", "scoring_system": "epss", "scoring_elements": "0.32053", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42131" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17377", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17377" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42131", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42131" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:21:43Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42131" }, { "reference_url": "https://github.com/advisories/GHSA-cx84-43xc-3gm2", "reference_id": "GHSA-cx84-43xc-3gm2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cx84-43xc-3gm2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26458?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.4" } ], "aliases": [ "CVE-2022-42131", "GHSA-cx84-43xc-3gm2" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vxds-7hfx-kkdq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52040?format=api", "vulnerability_id": "VCID-wt4h-fpcv-r3gq", "summary": "Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL\nThe Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42132", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00328", "scoring_system": "epss", "scoring_elements": "0.5602", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42132" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b6cff511119d71dea38f5485761730f4fb5d4430", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b6cff511119d71dea38f5485761730f4fb5d4430" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17438", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17438" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42132", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42132" }, { "reference_url": "https://web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132", "reference_id": "cve-2022-42132", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:17:39Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132" }, { "reference_url": "https://github.com/advisories/GHSA-f43m-hhj4-q3jg", "reference_id": "GHSA-f43m-hhj4-q3jg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f43m-hhj4-q3jg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26740?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5-ga5" }, { "url": "http://public2.vulnerablecode.io/api/packages/573951?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.6" } ], "aliases": [ "CVE-2022-42132", "GHSA-f43m-hhj4-q3jg" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wt4h-fpcv-r3gq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39151?format=api", "vulnerability_id": "VCID-x4dx-kkwq-z7ev", "summary": "Cross-site scripting in Liferay Portal\nCross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33939", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00296", "scoring_system": "epss", "scoring_elements": "0.53158", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33939" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:45:50Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33939", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33939" }, { "reference_url": "https://github.com/advisories/GHSA-53mw-69qx-q4fc", "reference_id": "GHSA-53mw-69qx-q4fc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-53mw-69qx-q4fc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26757?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.13" } ], "aliases": [ "CVE-2023-33939", "GHSA-53mw-69qx-q4fc" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x4dx-kkwq-z7ev" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10536?format=api", "vulnerability_id": "VCID-x9pp-w4xg-vyhn", "summary": "Liferay Portal defaults to a low work factor for the default password hashing algorithm\nThe default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25607", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00101", "scoring_system": "epss", "scoring_elements": "0.2747", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25607" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-20T13:27:04Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25607", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25607" }, { "reference_url": "https://github.com/advisories/GHSA-43h9-p3j4-39hm", "reference_id": "GHSA-43h9-p3j4-39hm", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-43h9-p3j4-39hm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27099?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.14" } ], "aliases": [ "CVE-2024-25607", "GHSA-43h9-p3j4-39hm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x9pp-w4xg-vyhn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10270?format=api", "vulnerability_id": "VCID-xrvs-e1n4-hqhb", "summary": "Liferay Portal denial-of-service vulnerability\nThe IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25144", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00318", "scoring_system": "epss", "scoring_elements": "0.55068", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25144" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-08T20:11:12Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25144", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25144" }, { "reference_url": "https://github.com/advisories/GHSA-w275-m8cr-hf2v", "reference_id": "GHSA-w275-m8cr-hf2v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w275-m8cr-hf2v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26528?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-c9pa-37x1-p3ev" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.27" } ], "aliases": [ "CVE-2024-25144", "GHSA-w275-m8cr-hf2v" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xrvs-e1n4-hqhb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52170?format=api", "vulnerability_id": "VCID-z4qp-1eef-dydq", "summary": "Authorization Bypass in Liferay Portal\nAn Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42129", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00191", "scoring_system": "epss", "scoring_elements": "0.4077", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42129" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17448", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17448" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42129", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42129" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:27:45Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42129" }, { "reference_url": "https://github.com/advisories/GHSA-g6x4-57hp-j4xm", "reference_id": "GHSA-g6x4-57hp-j4xm", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g6x4-57hp-j4xm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27041?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.5" } ], "aliases": [ "CVE-2022-42129", "GHSA-g6x4-57hp-j4xm" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z4qp-1eef-dydq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/27546?format=api", "vulnerability_id": "VCID-z667-1yu7-u3bm", "summary": "Liferay Portal Stores Password Reset Tokens in Plain Text\nLiferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62261", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00027", "scoring_system": "epss", "scoring_elements": "0.08134", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-62261" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17785", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17785" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-28T14:27:39Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62261", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.9", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62261" }, { "reference_url": "https://github.com/advisories/GHSA-xcj6-xpjg-c4xr", "reference_id": "GHSA-xcj6-xpjg-c4xr", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xcj6-xpjg-c4xr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/25608?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-47b2-112c-k3cp" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-67er-m849-9ff9" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-9tz8-yn1e-f7db" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bxja-uges-sbfk" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-qcw6-xjfx-2fbs" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uq1u-ksp5-c7eq" }, { "vulnerability": "VCID-wg1j-344t-57g1" }, { "vulnerability": "VCID-y3r9-9z2z-1yaf" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.100" } ], "aliases": [ "CVE-2025-62261", "GHSA-xcj6-xpjg-c4xr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z667-1yu7-u3bm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10177?format=api", "vulnerability_id": "VCID-z8y3-sx1w-7ycm", "summary": "Liferay Portal has an XXE vulnerability in Java2WsddTask._format\nXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25606", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00141", "scoring_system": "epss", "scoring_elements": "0.33887", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25606" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606", "reference_id": "", "reference_type": "", "scores": [ { "value": "8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T13:32:40Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25606", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25606" }, { "reference_url": "https://github.com/advisories/GHSA-869h-qhfx-w939", "reference_id": "GHSA-869h-qhfx-w939", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-869h-qhfx-w939" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/26220?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-1u12-aheq-gugg" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-2wm6-yd62-y7cz" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-35t3-f698-rkhx" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bkjh-fw5r-j7a4" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-ezuh-61ru-ubhq" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-gzp4-rcg3-u3bd" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-m9ma-tb7n-d3fs" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ss1z-bsed-mua3" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.3.8" } ], "aliases": [ "CVE-2024-25606", "GHSA-869h-qhfx-w939" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z8y3-sx1w-7ycm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/30887?format=api", "vulnerability_id": "VCID-zg4c-t4b5-rkgq", "summary": "Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery\nAn SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-4655", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00059", "scoring_system": "epss", "scoring_elements": "0.18754", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-4655" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-11T18:52:11Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4655" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4655", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4655" }, { "reference_url": "https://github.com/advisories/GHSA-c6g5-g6r7-q4j6", "reference_id": "GHSA-c6g5-g6r7-q4j6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-c6g5-g6r7-q4j6" } ], "fixed_packages": [], "aliases": [ "CVE-2025-4655", "GHSA-c6g5-g6r7-q4j6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zg4c-t4b5-rkgq" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51784?format=api", "vulnerability_id": "VCID-5hs7-m8g9-eff5", "summary": "Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module\nA SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.", "references": [ { "reference_url": "http://liferay.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42122", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00815", "scoring_system": "epss", "scoring_elements": "0.74588", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42122" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17520", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17520" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42122?p_r_p_assetEntryId=121613466&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613466%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42122?p_r_p_assetEntryId=121613466&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613466%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42122", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42122" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T14:59:30Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122" }, { "reference_url": "https://web.archive.org/web/20221115051621/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20221115051621/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122" }, { "reference_url": "https://github.com/advisories/GHSA-hw56-7xj4-7gx6", "reference_id": "GHSA-hw56-7xj4-7gx6", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hw56-7xj4-7gx6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/88104?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.0-ga1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.0-ga1" }, { "url": "http://public2.vulnerablecode.io/api/packages/72990?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5pe7-5247-suab" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-s9md-17hh-yfa3" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uk3w-ehxr-ybe7" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1" } ], "aliases": [ "CVE-2022-42122", "GHSA-hw56-7xj4-7gx6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5hs7-m8g9-eff5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39207?format=api", "vulnerability_id": "VCID-8a8h-22uc-zyhh", "summary": "Cross-site scripting in Liferay Portal\nCross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33938", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.53891", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-33938" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-22T15:46:09Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33938", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33938" }, { "reference_url": "https://github.com/advisories/GHSA-wvhw-5m89-64gv", "reference_id": "GHSA-wvhw-5m89-64gv", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wvhw-5m89-64gv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72990?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5pe7-5247-suab" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-s9md-17hh-yfa3" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uk3w-ehxr-ybe7" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1" } ], "aliases": [ "CVE-2023-33938", "GHSA-wvhw-5m89-64gv" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8a8h-22uc-zyhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55137?format=api", "vulnerability_id": "VCID-afv4-djc3-hqay", "summary": "Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module\nCross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-35463", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00149", "scoring_system": "epss", "scoring_elements": "0.3512", "published_at": "2026-05-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-35463" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-35463-reflected-xss-with-keywords-in-search?p_r_p_assetEntryId=121611661&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611661%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-35463-reflected-xss-with-keywords-in-search?p_r_p_assetEntryId=121611661&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611661%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35463", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35463" }, { "reference_url": "https://github.com/advisories/GHSA-9h7f-5hc8-cj5f", "reference_id": "GHSA-9h7f-5hc8-cj5f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9h7f-5hc8-cj5f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72990?format=api", "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.4.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-18rc-sf32-2uf1" }, { "vulnerability": "VCID-2f2r-qffz-mfgz" }, { "vulnerability": "VCID-2mj1-ag1g-cua8" }, { "vulnerability": "VCID-33gp-mfve-tfep" }, { "vulnerability": "VCID-36t8-hged-ekdu" }, { "vulnerability": "VCID-3c5w-ggtq-cqe7" }, { "vulnerability": "VCID-3f6j-kwvs-6ugd" }, { "vulnerability": "VCID-3mnz-y1dd-jbbw" }, { "vulnerability": "VCID-4jwq-krnu-4qar" }, { "vulnerability": "VCID-5748-cgs5-93c8" }, { "vulnerability": "VCID-59hg-58e6-q3hq" }, { "vulnerability": "VCID-5g5h-jjku-zufu" }, { "vulnerability": "VCID-5pe7-5247-suab" }, { "vulnerability": "VCID-5skb-shqz-5ff2" }, { "vulnerability": "VCID-68u4-q6vh-uqda" }, { "vulnerability": "VCID-6e8x-qeby-u3d1" }, { "vulnerability": "VCID-7jy4-y541-y7cy" }, { "vulnerability": "VCID-7yxf-sput-g7eb" }, { "vulnerability": "VCID-814s-t8yb-7bhw" }, { "vulnerability": "VCID-8a6x-92ay-jugc" }, { "vulnerability": "VCID-8fv2-ugm3-qfh3" }, { "vulnerability": "VCID-8xj7-x2xq-9beg" }, { "vulnerability": "VCID-98s7-bcmu-tkaw" }, { "vulnerability": "VCID-9sb7-qrgp-1yf9" }, { "vulnerability": "VCID-a3ry-pezq-9bg9" }, { "vulnerability": "VCID-aykp-anzz-3ueg" }, { "vulnerability": "VCID-b82g-xw43-rkhz" }, { "vulnerability": "VCID-bzej-3ua8-4yaj" }, { "vulnerability": "VCID-c86c-e9ym-jud2" }, { "vulnerability": "VCID-cbt7-tube-jkgz" }, { "vulnerability": "VCID-da1k-nezs-xfh8" }, { "vulnerability": "VCID-dah3-w7pd-43cp" }, { "vulnerability": "VCID-daxj-5xz8-d3g3" }, { "vulnerability": "VCID-dnv6-swpp-cuee" }, { "vulnerability": "VCID-ejsh-acyx-2bda" }, { "vulnerability": "VCID-er8v-jdqz-4fbw" }, { "vulnerability": "VCID-erjj-fcds-2ydh" }, { "vulnerability": "VCID-fbkn-d96m-gyas" }, { "vulnerability": "VCID-fd71-whkv-17hz" }, { "vulnerability": "VCID-gnwg-4bcp-2fep" }, { "vulnerability": "VCID-gv9f-cur9-2be3" }, { "vulnerability": "VCID-h4n5-jx1f-1bhj" }, { "vulnerability": "VCID-hrcr-arpj-t7h1" }, { "vulnerability": "VCID-ht7d-5a1n-vyap" }, { "vulnerability": "VCID-j1bu-gxq7-abcx" }, { "vulnerability": "VCID-j1sr-kz76-wuew" }, { "vulnerability": "VCID-j4w5-6t6r-3fer" }, { "vulnerability": "VCID-j6nv-5sjy-ykdy" }, { "vulnerability": "VCID-jhpw-jb9e-xqhj" }, { "vulnerability": "VCID-jmxy-p9t5-ayau" }, { "vulnerability": "VCID-kprn-p4ys-zyep" }, { "vulnerability": "VCID-mwc1-h7hq-y3fg" }, { "vulnerability": "VCID-ngx4-7y39-63bf" }, { "vulnerability": "VCID-nh3b-vkjh-y7ee" }, { "vulnerability": "VCID-nt12-fes6-xbez" }, { "vulnerability": "VCID-nzn2-n9hz-67ea" }, { "vulnerability": "VCID-p5ek-t5kg-k7d1" }, { "vulnerability": "VCID-pr4k-p1kc-gfdt" }, { "vulnerability": "VCID-q8ay-yhsa-s7be" }, { "vulnerability": "VCID-q9n2-r73c-v3cg" }, { "vulnerability": "VCID-r3y7-a2q2-9fcn" }, { "vulnerability": "VCID-rrc5-43t6-yfb2" }, { "vulnerability": "VCID-rxpu-tuhm-e7ew" }, { "vulnerability": "VCID-rxws-w8x6-sua4" }, { "vulnerability": "VCID-s9md-17hh-yfa3" }, { "vulnerability": "VCID-sect-yjwh-1qew" }, { "vulnerability": "VCID-ssys-9pqn-9kd7" }, { "vulnerability": "VCID-tn86-egxy-1fcq" }, { "vulnerability": "VCID-uk3w-ehxr-ybe7" }, { "vulnerability": "VCID-ur67-cmfj-mbas" }, { "vulnerability": "VCID-uwbr-2985-s7ed" }, { "vulnerability": "VCID-vxds-7hfx-kkdq" }, { "vulnerability": "VCID-wt4h-fpcv-r3gq" }, { "vulnerability": "VCID-x4dx-kkwq-z7ev" }, { "vulnerability": "VCID-x9pp-w4xg-vyhn" }, { "vulnerability": "VCID-xrvs-e1n4-hqhb" }, { "vulnerability": "VCID-z4qp-1eef-dydq" }, { "vulnerability": "VCID-z667-1yu7-u3bm" }, { "vulnerability": "VCID-z8y3-sx1w-7ycm" }, { "vulnerability": "VCID-zg4c-t4b5-rkgq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1" } ], "aliases": [ "CVE-2021-35463", "GHSA-9h7f-5hc8-cj5f" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-afv4-djc3-hqay" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.4.1" }