GET

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

GET /api/vulnerabilities/47063?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47063?format=api",
    "vulnerability_id": "VCID-mcea-q7za-duay",
    "summary": "Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions\nLiferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.",
    "aliases": [
        {
            "alias": "CVE-2024-25604"
        },
        {
            "alias": "GHSA-pw7p-3648-qqmg"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/68818?format=api",
            "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-7gqd-78yq-r3be"
                },
                {
                    "vulnerability": "VCID-ebmm-3qj1-8uec"
                },
                {
                    "vulnerability": "VCID-euw1-6mk1-n3he"
                },
                {
                    "vulnerability": "VCID-fxtu-zgpf-cbhs"
                },
                {
                    "vulnerability": "VCID-menx-yu2z-xkeh"
                },
                {
                    "vulnerability": "VCID-p4nc-ucxy-sydb"
                },
                {
                    "vulnerability": "VCID-rtqu-78p2-buej"
                },
                {
                    "vulnerability": "VCID-vsg8-h11j-63ge"
                },
                {
                    "vulnerability": "VCID-xe2v-j69t-d3h3"
                },
                {
                    "vulnerability": "VCID-xu7c-vz69-duhp"
                },
                {
                    "vulnerability": "VCID-zc36-wq6m-4bbn"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/512873?format=api",
            "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-42k1-vb9z-3qe7"
                },
                {
                    "vulnerability": "VCID-9hvg-h2ra-nbcc"
                },
                {
                    "vulnerability": "VCID-c3ym-wtv5-hfhr"
                },
                {
                    "vulnerability": "VCID-d8m3-apv8-zfe1"
                },
                {
                    "vulnerability": "VCID-ef5k-bdxm-xfer"
                },
                {
                    "vulnerability": "VCID-gkn8-ehfa-3ugx"
                },
                {
                    "vulnerability": "VCID-mcea-q7za-duay"
                },
                {
                    "vulnerability": "VCID-menx-yu2z-xkeh"
                },
                {
                    "vulnerability": "VCID-rtqu-78p2-buej"
                },
                {
                    "vulnerability": "VCID-tqvb-a46r-jbf8"
                },
                {
                    "vulnerability": "VCID-uu3m-ef36-jqg7"
                },
                {
                    "vulnerability": "VCID-xe2v-j69t-d3h3"
                },
                {
                    "vulnerability": "VCID-xwgk-d28b-rbgz"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/68799?format=api",
            "purl": "pkg:maven/com.liferay.portal/release.portal.bom@7.2.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-17tm-rzgk-qfas"
                },
                {
                    "vulnerability": "VCID-1fqz-psdf-g7dm"
                },
                {
                    "vulnerability": "VCID-1h16-mptk-gke7"
                },
                {
                    "vulnerability": "VCID-266t-4gfq-duh4"
                },
                {
                    "vulnerability": "VCID-2dc6-guhs-juhy"
                },
                {
                    "vulnerability": "VCID-2fn6-apud-qbh4"
                },
                {
                    "vulnerability": "VCID-2gt6-dn6q-z3bc"
                },
                {
                    "vulnerability": "VCID-3nm8-13hg-myh4"
                },
                {
                    "vulnerability": "VCID-4611-azkf-sffv"
                },
                {
                    "vulnerability": "VCID-68kz-zfvf-7ucw"
                },
                {
                    "vulnerability": "VCID-6q85-j656-wyeh"
                },
                {
                    "vulnerability": "VCID-6yj4-11z6-pfhx"
                },
                {
                    "vulnerability": "VCID-77qw-vmwe-x3d4"
                },
                {
                    "vulnerability": "VCID-8jv6-163j-a7b2"
                },
                {
                    "vulnerability": "VCID-9471-umbz-pucy"
                },
                {
                    "vulnerability": "VCID-9yw4-52sc-rbbz"
                },
                {
                    "vulnerability": "VCID-a7z8-2fzy-2qee"
                },
                {
                    "vulnerability": "VCID-c4kq-8dpb-bkc7"
                },
                {
                    "vulnerability": "VCID-e5c7-wsvb-dyfm"
                },
                {
                    "vulnerability": "VCID-ebzh-bpks-5qe2"
                },
                {
                    "vulnerability": "VCID-g2jp-ueyr-gkav"
                },
                {
                    "vulnerability": "VCID-ggs5-4zac-vqa7"
                },
                {
                    "vulnerability": "VCID-gz3a-m337-s7dn"
                },
                {
                    "vulnerability": "VCID-hw1d-gdcv-vkec"
                },
                {
                    "vulnerability": "VCID-k1u8-ur3y-zucd"
                },
                {
                    "vulnerability": "VCID-k29y-9nww-cuh6"
                },
                {
                    "vulnerability": "VCID-k9yt-aj7x-3bht"
                },
                {
                    "vulnerability": "VCID-m1tw-29pq-h3gw"
                },
                {
                    "vulnerability": "VCID-m52g-mrb5-ufcq"
                },
                {
                    "vulnerability": "VCID-mcea-q7za-duay"
                },
                {
                    "vulnerability": "VCID-p9am-1rhf-6bh2"
                },
                {
                    "vulnerability": "VCID-qar1-pfr5-ekfm"
                },
                {
                    "vulnerability": "VCID-qks2-mqk8-wffq"
                },
                {
                    "vulnerability": "VCID-sn9p-y571-ffej"
                },
                {
                    "vulnerability": "VCID-t51p-askk-pfcx"
                },
                {
                    "vulnerability": "VCID-ub82-jbgf-mfb8"
                },
                {
                    "vulnerability": "VCID-uv23-yfgk-87h9"
                },
                {
                    "vulnerability": "VCID-vkgz-zx58-3yet"
                },
                {
                    "vulnerability": "VCID-vrqa-ggse-wqhn"
                },
                {
                    "vulnerability": "VCID-wwhx-5znm-nyea"
                },
                {
                    "vulnerability": "VCID-y8xm-g4zt-b7b5"
                },
                {
                    "vulnerability": "VCID-yq5x-4eyq-m7ba"
                },
                {
                    "vulnerability": "VCID-yump-6eg9-9yeq"
                },
                {
                    "vulnerability": "VCID-zmf4-acz8-s3a2"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.portal.bom@7.2.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25604",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "0.00089",
                    "scoring_system": "epss",
                    "scoring_elements": "0.2545",
                    "published_at": "2026-06-05T12:55:00Z"
                }
            ],
            "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25604"
        },
        {
            "reference_url": "https://github.com/liferay/liferay-portal",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "6.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/liferay/liferay-portal"
        },
        {
            "reference_url": "https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "6.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724"
        },
        {
            "reference_url": "https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "6.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e"
        },
        {
            "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604",
            "reference_id": "CVE-2024-25604",
            "reference_type": "",
            "scores": [
                {
                    "value": "6.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                },
                {
                    "value": "Track",
                    "scoring_system": "ssvc",
                    "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:38:45Z/"
                }
            ],
            "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25604",
            "reference_id": "CVE-2024-25604",
            "reference_type": "",
            "scores": [
                {
                    "value": "6.5",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25604"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-pw7p-3648-qqmg",
            "reference_id": "GHSA-pw7p-3648-qqmg",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "cvssv3.1_qr",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/advisories/GHSA-pw7p-3648-qqmg"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 863,
            "name": "Incorrect Authorization",
            "description": "The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        },
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        }
    ],
    "exploits": [],
    "severity_range_score": "4.0 - 6.9",
    "exploitability": "0.5",
    "weighted_severity": "6.2",
    "risk_score": 3.1,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mcea-q7za-duay"
}