Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/539023?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/539023?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp10", "type": "maven", "namespace": "com.liferay.portal", "name": "release.dxp.bom", "version": "7.1.10.fp10", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "7.4.13.u93", "latest_non_vulnerable_version": "7.4.13.u93", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210493?format=api", "vulnerability_id": "VCID-1gd6-wm47-ufad", "summary": "Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33320", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00392", "scoring_system": "epss", "scoring_elements": "0.60717", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00392", "scoring_system": "epss", "scoring_elements": "0.60612", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00392", "scoring_system": "epss", "scoring_elements": "0.60719", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00392", "scoring_system": "epss", "scoring_elements": "0.60728", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33320" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17007", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17007" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33320-flagging-content-as-inappropriate-is-not-rate-limited?p_r_p_assetEntryId=121611464&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611464%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33320-flagging-content-as-inappropriate-is-not-rate-limited?p_r_p_assetEntryId=121611464&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611464%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33320", "reference_id": "CVE-2021-33320", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33320" }, { "reference_url": "https://github.com/advisories/GHSA-wg4x-hf94-fj5v", "reference_id": "GHSA-wg4x-hf94-fj5v", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wg4x-hf94-fj5v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/19213?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5" } ], "aliases": [ "CVE-2021-33320", "GHSA-wg4x-hf94-fj5v" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1gd6-wm47-ufad" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210495?format=api", "vulnerability_id": "VCID-1k1u-jptu-n3d7", "summary": "Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33337", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00258", "scoring_system": "epss", "scoring_elements": "0.49673", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00258", "scoring_system": "epss", "scoring_elements": "0.49536", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00258", "scoring_system": "epss", "scoring_elements": "0.49679", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00258", "scoring_system": "epss", "scoring_elements": "0.49692", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33337" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/432e9eb911d11ff40e1db652690586e496940633", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/432e9eb911d11ff40e1db652690586e496940633" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17101", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17101" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2021-33337", "reference_id": "CVE-2021-33337", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2021-33337" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33337", "reference_id": "CVE-2021-33337", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33337" }, { "reference_url": "https://github.com/advisories/GHSA-v88g-7fx4-9q7f", "reference_id": "GHSA-v88g-7fx4-9q7f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v88g-7fx4-9q7f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/23551?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9" } ], "aliases": [ "CVE-2021-33337", "GHSA-v88g-7fx4-9q7f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1k1u-jptu-n3d7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41341?format=api", "vulnerability_id": "VCID-48hp-m4m8-cqge", "summary": "In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26267", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00224", "scoring_system": "epss", "scoring_elements": "0.45373", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00224", "scoring_system": "epss", "scoring_elements": "0.45385", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00224", "scoring_system": "epss", "scoring_elements": "0.45224", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26267" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267", "reference_id": "cve-2024-26267", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T15:20:52Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26267", "reference_id": "CVE-2024-26267", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26267" }, { "reference_url": "https://github.com/advisories/GHSA-2mvj-q2q3-wxjv", "reference_id": "GHSA-2mvj-q2q3-wxjv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2mvj-q2q3-wxjv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27467?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/27470?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u5" }, { "url": "http://public2.vulnerablecode.io/api/packages/29160?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4jau-1np8-6fd5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n2zu-prgr-dkfn" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u26" } ], "aliases": [ "CVE-2024-26267", "GHSA-2mvj-q2q3-wxjv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-48hp-m4m8-cqge" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210488?format=api", "vulnerability_id": "VCID-4qnf-vd8e-9yfr", "summary": "Liferay Portal and Liferay DXP Stores User Passwords in Cleartext", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33325", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00123", "scoring_system": "epss", "scoring_elements": "0.3118", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00123", "scoring_system": "epss", "scoring_elements": "0.30985", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00123", "scoring_system": "epss", "scoring_elements": "0.31178", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00123", "scoring_system": "epss", "scoring_elements": "0.31195", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33325" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17042", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17042" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33325", "reference_id": "CVE-2021-33325", "reference_type": "", "scores": [ { "value": "4.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33325" }, { "reference_url": "https://github.com/advisories/GHSA-6c88-gvxw-f5hg", "reference_id": "GHSA-6c88-gvxw-f5hg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6c88-gvxw-f5hg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2021-33325", "GHSA-6c88-gvxw-f5hg" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4qnf-vd8e-9yfr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208339?format=api", "vulnerability_id": "VCID-6aqp-gny4-5ffp", "summary": "Liferay Portal and Liferay DXP fails to check origin of event messages", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25146", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34024", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.33845", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34023", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34045", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-25146" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps?p_r_p_assetEntryId=121612000&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612000%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps?p_r_p_assetEntryId=121612000&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612000%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25146", "reference_id": "CVE-2022-25146", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25146" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps", "reference_id": "CVE-2022-25146-CSRF-TOKEN-EXFILTRATION-VIA-REMOTE-APPS", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps" }, { "reference_url": "https://github.com/advisories/GHSA-ghw5-998m-vw4w", "reference_id": "GHSA-ghw5-998m-vw4w", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-ghw5-998m-vw4w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19581?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4jau-1np8-6fd5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u5" } ], "aliases": [ "CVE-2022-25146", "GHSA-ghw5-998m-vw4w" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6aqp-gny4-5ffp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210479?format=api", "vulnerability_id": "VCID-6ejn-7nds-1qb6", "summary": "Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33333", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00285", "scoring_system": "epss", "scoring_elements": "0.52337", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00285", "scoring_system": "epss", "scoring_elements": "0.52208", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00285", "scoring_system": "epss", "scoring_elements": "0.5233", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00285", "scoring_system": "epss", "scoring_elements": "0.52348", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33333" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17032", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17032" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33333", "reference_id": "CVE-2021-33333", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33333" }, { "reference_url": "https://github.com/advisories/GHSA-g7xc-m762-wg8f", "reference_id": "GHSA-g7xc-m762-wg8f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g7xc-m762-wg8f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/19214?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6" } ], "aliases": [ "CVE-2021-33333", "GHSA-g7xc-m762-wg8f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6ejn-7nds-1qb6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208049?format=api", "vulnerability_id": "VCID-6gyp-c7wt-qfb5", "summary": "Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15839", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01076", "scoring_system": "epss", "scoring_elements": "0.78279", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01076", "scoring_system": "epss", "scoring_elements": "0.78211", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01076", "scoring_system": "epss", "scoring_elements": "0.78288", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01076", "scoring_system": "epss", "scoring_elements": "0.78293", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15839" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17029", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17029" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17055", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17055" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15839", "reference_id": "CVE-2020-15839", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15839" }, { "reference_url": "https://github.com/advisories/GHSA-c7f6-4vx5-4263", "reference_id": "GHSA-c7f6-4vx5-4263", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-c7f6-4vx5-4263" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19216?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18" }, { "url": "http://public2.vulnerablecode.io/api/packages/19214?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6" } ], "aliases": [ "CVE-2020-15839", "GHSA-c7f6-4vx5-4263" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6gyp-c7wt-qfb5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210413?format=api", "vulnerability_id": "VCID-76r8-wfvh-pkg4", "summary": "Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29040", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00402", "scoring_system": "epss", "scoring_elements": "0.61375", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00402", "scoring_system": "epss", "scoring_elements": "0.61266", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00402", "scoring_system": "epss", "scoring_elements": "0.61371", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00402", "scoring_system": "epss", "scoring_elements": "0.61379", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29040" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429" }, { "reference_url": "https://web.archive.org/web/20220828222656/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20220828222656/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29040", "reference_id": "CVE-2021-29040", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29040" }, { "reference_url": "https://github.com/advisories/GHSA-87x7-pwrx-jch7", "reference_id": "GHSA-87x7-pwrx-jch7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-87x7-pwrx-jch7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/19552?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10" } ], "aliases": [ "CVE-2021-29040", "GHSA-87x7-pwrx-jch7" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-76r8-wfvh-pkg4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210421?format=api", "vulnerability_id": "VCID-91rc-5gz3-dbcf", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29048", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6534", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6523", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6533", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.65341", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29048" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601" }, { "reference_url": "https://web.archive.org/web/20210524222536/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210524222536/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29048", "reference_id": "CVE-2021-29048", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29048" }, { "reference_url": "https://github.com/advisories/GHSA-4fx8-82f3-xcpc", "reference_id": "GHSA-4fx8-82f3-xcpc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4fx8-82f3-xcpc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23388?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp11" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29048", "GHSA-4fx8-82f3-xcpc" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-91rc-5gz3-dbcf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/322077?format=api", "vulnerability_id": "VCID-9bfa-6qqd-d7gb", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13444", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00249", "scoring_system": "epss", "scoring_elements": "0.48463", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00249", "scoring_system": "epss", "scoring_elements": "0.48601", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00249", "scoring_system": "epss", "scoring_elements": "0.4862", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00249", "scoring_system": "epss", "scoring_elements": "0.48606", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13444" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17009", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17009" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13444" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396" }, { "reference_url": "https://github.com/advisories/GHSA-8j5r-9687-88w5", "reference_id": "GHSA-8j5r-9687-88w5", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8j5r-9687-88w5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2020-13444", "GHSA-8j5r-9687-88w5" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9bfa-6qqd-d7gb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/32585?format=api", "vulnerability_id": "VCID-9u32-4n1x-77ce", "summary": "HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25608", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1765", "scoring_system": "epss", "scoring_elements": "0.95251", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.1765", "scoring_system": "epss", "scoring_elements": "0.95273", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.1765", "scoring_system": "epss", "scoring_elements": "0.95266", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.1765", "scoring_system": "epss", "scoring_elements": "0.95271", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25608" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/36adf82ef7a09c7035d4f19a1982dcde1ae3f6ae" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/aea651fa5110934b6a00d93391fac87985e27786" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608", "reference_id": "cve-2024-25608", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T17:50:15Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25608", "reference_id": "CVE-2024-25608", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25608" }, { "reference_url": "https://github.com/advisories/GHSA-548x-j6x6-hcv4", "reference_id": "GHSA-548x-j6x6-hcv4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-548x-j6x6-hcv4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27467?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/27874?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4" }, { "url": "http://public2.vulnerablecode.io/api/packages/29154?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4jau-1np8-6fd5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n2zu-prgr-dkfn" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u19" } ], "aliases": [ "CVE-2024-25608", "GHSA-548x-j6x6-hcv4" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9u32-4n1x-77ce" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208991?format=api", "vulnerability_id": "VCID-9xdb-721c-hqgf", "summary": "Liferay Portal and Liferay DXP allows arbitrary injection via web content template names", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26596", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.46099", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.45962", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.46107", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.46113", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26596" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c61976fc867f3add8eb429b99380e91f021f9313", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c61976fc867f3add8eb429b99380e91f021f9313" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26596-stored-xss-with-template-name?p_r_p_assetEntryId=121612108&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612108%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26596-stored-xss-with-template-name?p_r_p_assetEntryId=121612108&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612108%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26596", "reference_id": "CVE-2022-26596", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26596" }, { "reference_url": "https://github.com/advisories/GHSA-w7f2-6896-6mm2", "reference_id": "GHSA-w7f2-6896-6mm2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w7f2-6896-6mm2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/20299?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp8" } ], "aliases": [ "CVE-2022-26596", "GHSA-w7f2-6896-6mm2" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9xdb-721c-hqgf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41619?format=api", "vulnerability_id": "VCID-a62g-s5j4-73fr", "summary": "User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26268", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.54091", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.54221", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.54216", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00304", "scoring_system": "epss", "scoring_elements": "0.54233", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-26268" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268", "reference_id": "cve-2024-26268", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:17:11Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26268", "reference_id": "CVE-2024-26268", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26268" }, { "reference_url": "https://github.com/advisories/GHSA-qm43-g2xj-hvg5", "reference_id": "GHSA-qm43-g2xj-hvg5", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qm43-g2xj-hvg5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/29138?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" }, { "vulnerability": "VCID-zn2s-8c79-x7h3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/27863?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u8" }, { "url": "http://public2.vulnerablecode.io/api/packages/28823?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4jau-1np8-6fd5" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n2zu-prgr-dkfn" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u27" } ], "aliases": [ "CVE-2024-26268", "GHSA-qm43-g2xj-hvg5" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a62g-s5j4-73fr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210480?format=api", "vulnerability_id": "VCID-b12f-kdez-2qau", "summary": "Liferay Portal and Liferay DXP Fails to Properly Check User Permissions", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33334", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24094", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.23897", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24081", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00081", "scoring_system": "epss", "scoring_elements": "0.24102", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33334" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17039", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17039" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33334", "reference_id": "CVE-2021-33334", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33334" }, { "reference_url": "https://github.com/advisories/GHSA-g37f-j8hh-736f", "reference_id": "GHSA-g37f-j8hh-736f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-g37f-j8hh-736f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/19214?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6" } ], "aliases": [ "CVE-2021-33334", "GHSA-g37f-j8hh-736f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-b12f-kdez-2qau" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210418?format=api", "vulnerability_id": "VCID-bmbd-g58w-z3gy", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29051", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00317", "scoring_system": "epss", "scoring_elements": "0.55329", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00317", "scoring_system": "epss", "scoring_elements": "0.55205", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00317", "scoring_system": "epss", "scoring_elements": "0.55327", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00317", "scoring_system": "epss", "scoring_elements": "0.55343", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29051" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580" }, { "reference_url": "https://web.archive.org/web/20210524223247/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210524223247/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29051", "reference_id": "CVE-2021-29051", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29051" }, { "reference_url": "https://github.com/advisories/GHSA-jvvx-8g42-9559", "reference_id": "GHSA-jvvx-8g42-9559", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jvvx-8g42-9559" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19556?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21" }, { "url": "http://public2.vulnerablecode.io/api/packages/541053?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22" }, { "url": "http://public2.vulnerablecode.io/api/packages/19552?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29051", "GHSA-jvvx-8g42-9559" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bmbd-g58w-z3gy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/165421?format=api", "vulnerability_id": "VCID-bvbr-288p-xkak", "summary": "Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28980", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00247", "scoring_system": "epss", "scoring_elements": "0.48421", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00247", "scoring_system": "epss", "scoring_elements": "0.48281", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00247", "scoring_system": "epss", "scoring_elements": "0.48418", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00247", "scoring_system": "epss", "scoring_elements": "0.48436", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28980" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b4ea3e9acb6c3602b9c90538ba35f11906dc07ed", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b4ea3e9acb6c3602b9c90538ba35f11906dc07ed" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17420", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17420" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28980-reflected-xss-with-filter_-parameters-in-applied-fragment-filters?p_r_p_assetEntryId=121612438&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612438%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28980-reflected-xss-with-filter_-parameters-in-applied-fragment-filters?p_r_p_assetEntryId=121612438&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612438%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28980", "reference_id": "CVE-2022-28980", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28980" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters", "reference_id": "cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T17:48:12Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters" }, { "reference_url": "https://web.archive.org/web/20221114081624/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_*-parameters-in-applied-fragment-filters", "reference_id": "CVE-2022-28980-REFLECTED-XSS-WITH-FILTER_*-PARAMETERS-IN-APPLIED-FRAGMENT-FILTERS", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20221114081624/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_*-parameters-in-applied-fragment-filters" }, { "reference_url": "https://github.com/advisories/GHSA-8mp9-w7gr-pvj3", "reference_id": "GHSA-8mp9-w7gr-pvj3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8mp9-w7gr-pvj3" }, { "reference_url": "http://liferay.com", "reference_id": "liferay.com", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T17:48:12Z/" } ], "url": "http://liferay.com" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27016?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.3.5-ga5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.3.5-ga5" }, { "url": "http://public2.vulnerablecode.io/api/packages/29239?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.10.ep1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4jau-1np8-6fd5" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zc53-8p5g-2kcv" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.10.ep1" } ], "aliases": [ "CVE-2022-28980", "GHSA-8mp9-w7gr-pvj3" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bvbr-288p-xkak" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210655?format=api", "vulnerability_id": "VCID-cdmw-ujbw-yqbj", "summary": "Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33322", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00223", "scoring_system": "epss", "scoring_elements": "0.45284", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00223", "scoring_system": "epss", "scoring_elements": "0.45134", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00223", "scoring_system": "epss", "scoring_elements": "0.45296", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33322" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/8f072ee8527a1dd5c0ffa91c4a78641d0e666b95", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/8f072ee8527a1dd5c0ffa91c4a78641d0e666b95" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9fe453b34f58286a504d995be8ba50499adcf1b7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9fe453b34f58286a504d995be8ba50499adcf1b7" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-16981", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-16981" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33322-password-change-does-not-invalidate-password-reset-tokens?p_r_p_assetEntryId=121610648&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610648%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33322-password-change-does-not-invalidate-password-reset-tokens?p_r_p_assetEntryId=121610648&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610648%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33322", "reference_id": "CVE-2021-33322", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33322" }, { "reference_url": "https://github.com/advisories/GHSA-vwj8-4grf-3r8v", "reference_id": "GHSA-vwj8-4grf-3r8v", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vwj8-4grf-3r8v" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19216?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18" }, { "url": "http://public2.vulnerablecode.io/api/packages/19213?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5" } ], "aliases": [ "CVE-2021-33322", "GHSA-vwj8-4grf-3r8v" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cdmw-ujbw-yqbj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/156411?format=api", "vulnerability_id": "VCID-ckbc-n5n3-dka6", "summary": "Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29038", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00094", "scoring_system": "epss", "scoring_elements": "0.26285", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00094", "scoring_system": "epss", "scoring_elements": "0.26486", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00094", "scoring_system": "epss", "scoring_elements": "0.265", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00094", "scoring_system": "epss", "scoring_elements": "0.26487", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29038" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5e2da784aeefce64107abd0411590db2b55faf0b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5e2da784aeefce64107abd0411590db2b55faf0b" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-29038", "reference_id": "cve-2021-29038", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T16:45:01Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-29038" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29038", "reference_id": "CVE-2021-29038", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29038" }, { "reference_url": "https://github.com/advisories/GHSA-mwhf-6mjm-6w3h", "reference_id": "GHSA-mwhf-6mjm-6w3h", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mwhf-6mjm-6w3h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27872?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29038", "GHSA-mwhf-6mjm-6w3h" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ckbc-n5n3-dka6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210414?format=api", "vulnerability_id": "VCID-cn4z-f8ej-ruha", "summary": "Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29047", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00288", "scoring_system": "epss", "scoring_elements": "0.52783", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00288", "scoring_system": "epss", "scoring_elements": "0.52658", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00288", "scoring_system": "epss", "scoring_elements": "0.52786", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00288", "scoring_system": "epss", "scoring_elements": "0.52801", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29047" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://web.archive.org/web/20210524180455/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210524180455/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29047", "reference_id": "CVE-2021-29047", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29047" }, { "reference_url": "https://github.com/advisories/GHSA-9mxg-p873-6793", "reference_id": "GHSA-9mxg-p873-6793", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9mxg-p873-6793" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29047", "GHSA-9mxg-p873-6793" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cn4z-f8ej-ruha" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/322078?format=api", "vulnerability_id": "VCID-dy73-grbk-tyb6", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13445", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0371", "scoring_system": "epss", "scoring_elements": "0.88233", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0371", "scoring_system": "epss", "scoring_elements": "0.88273", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0371", "scoring_system": "epss", "scoring_elements": "0.88279", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0371", "scoring_system": "epss", "scoring_elements": "0.88278", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13445" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17023", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17023" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13445", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13445" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411" }, { "reference_url": "https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce" }, { "reference_url": "https://github.com/advisories/GHSA-v377-8f8f-532h", "reference_id": "GHSA-v377-8f8f-532h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v377-8f8f-532h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19216?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18" }, { "url": "http://public2.vulnerablecode.io/api/packages/19214?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6" } ], "aliases": [ "CVE-2020-13445", "GHSA-v377-8f8f-532h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dy73-grbk-tyb6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210491?format=api", "vulnerability_id": "VCID-fer2-q3rr-2khd", "summary": "Liferay Portal and Liferay DXP Don't Check Permissions of Pages", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33324", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00121", "scoring_system": "epss", "scoring_elements": "0.30917", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00121", "scoring_system": "epss", "scoring_elements": "0.30719", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00121", "scoring_system": "epss", "scoring_elements": "0.30919", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00121", "scoring_system": "epss", "scoring_elements": "0.30934", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33324" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17001", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17001" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063" }, { "reference_url": "https://web.archive.org/web/20220828222955/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20220828222955/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33324", "reference_id": "CVE-2021-33324", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33324" }, { "reference_url": "https://github.com/advisories/GHSA-474f-cmx5-gm69", "reference_id": "GHSA-474f-cmx5-gm69", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-474f-cmx5-gm69" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/19213?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5" } ], "aliases": [ "CVE-2021-33324", "GHSA-474f-cmx5-gm69" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fer2-q3rr-2khd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210499?format=api", "vulnerability_id": "VCID-fx8b-2pzj-uyg6", "summary": "Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33336", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00167", "scoring_system": "epss", "scoring_elements": "0.37808", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00167", "scoring_system": "epss", "scoring_elements": "0.3763", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00167", "scoring_system": "epss", "scoring_elements": "0.37821", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00167", "scoring_system": "epss", "scoring_elements": "0.37833", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33336" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17078", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17078" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33336", "reference_id": "CVE-2021-33336", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33336" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name", "reference_id": "CVE-2021-33336-STORED-XSS-WITH-STRUCTURE-NAME", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name" }, { "reference_url": "https://github.com/advisories/GHSA-fvg6-9r88-7w85", "reference_id": "GHSA-fvg6-9r88-7w85", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fvg6-9r88-7w85" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19216?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp18" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2021-33336", "GHSA-fvg6-9r88-7w85" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fx8b-2pzj-uyg6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/32281?format=api", "vulnerability_id": "VCID-g52h-8r1h-dfhe", "summary": "Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25145", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35693", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35883", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35874", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00152", "scoring_system": "epss", "scoring_elements": "0.35896", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25145" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145", "reference_id": "cve-2024-25145", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-02-08T17:02:17Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25145", "reference_id": "CVE-2024-25145", "reference_type": "", "scores": [ { "value": "9.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25145" }, { "reference_url": "https://github.com/advisories/GHSA-9vgq-w5pv-v77q", "reference_id": "GHSA-9vgq-w5pv-v77q", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9vgq-w5pv-v77q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27872?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17" }, { "url": "http://public2.vulnerablecode.io/api/packages/27874?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4" }, { "url": "http://public2.vulnerablecode.io/api/packages/28805?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.3.13u8", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.3.13u8" } ], "aliases": [ "CVE-2024-25145", "GHSA-9vgq-w5pv-v77q" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g52h-8r1h-dfhe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210425?format=api", "vulnerability_id": "VCID-g6wt-vwuh-cua8", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29044", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6534", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6523", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.6533", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.65341", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29044" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://web.archive.org/web/20210524195727/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210524195727/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29044", "reference_id": "CVE-2021-29044", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29044" }, { "reference_url": "https://github.com/advisories/GHSA-wcr5-3q96-c2gr", "reference_id": "GHSA-wcr5-3q96-c2gr", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wcr5-3q96-c2gr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19556?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21" }, { "url": "http://public2.vulnerablecode.io/api/packages/541053?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22" }, { "url": "http://public2.vulnerablecode.io/api/packages/19552?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29044", "GHSA-wcr5-3q96-c2gr" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g6wt-vwuh-cua8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/166213?format=api", "vulnerability_id": "VCID-gkpd-2p17-7fcq", "summary": "A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42121", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00605", "scoring_system": "epss", "scoring_elements": "0.70196", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00605", "scoring_system": "epss", "scoring_elements": "0.70093", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00605", "scoring_system": "epss", "scoring_elements": "0.70184", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00605", "scoring_system": "epss", "scoring_elements": "0.70198", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42121" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/14c8fbbac814c0b511b4f3ade19eafb2182923c7", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/14c8fbbac814c0b511b4f3ade19eafb2182923c7" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5a17acb714c57e36695b7caff8e6a2789e2cf9d0", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5a17acb714c57e36695b7caff8e6a2789e2cf9d0" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/82de94e9f3a4425e3ee6c187462d670ae9bfef51", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/82de94e9f3a4425e3ee6c187462d670ae9bfef51" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f245f4b428186c8e5964a9ffe90ccc7e12cf7f66", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f245f4b428186c8e5964a9ffe90ccc7e12cf7f66" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42121?p_r_p_assetEntryId=121613426&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613426%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42121?p_r_p_assetEntryId=121613426&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613426%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121", "reference_id": "cve-2022-42121", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T15:01:37Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42121", "reference_id": "CVE-2022-42121", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42121" }, { "reference_url": "https://github.com/advisories/GHSA-gxxj-fhmr-37j9", "reference_id": "GHSA-gxxj-fhmr-37j9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gxxj-fhmr-37j9" }, { "reference_url": "http://liferay.com", "reference_id": "liferay.com", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T15:01:37Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17414", "reference_id": "LPE-17414", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-04-30T15:01:37Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17414" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27860?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27" }, { "url": "http://public2.vulnerablecode.io/api/packages/27872?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17" } ], "aliases": [ "CVE-2022-42121", "GHSA-gxxj-fhmr-37j9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gkpd-2p17-7fcq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/60411?format=api", "vulnerability_id": "VCID-gngs-dm98-eqc2", "summary": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-11993", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38976", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.3899", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38804", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38999", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-11993" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11993", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11993" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993", "reference_id": "CVE-2024-11993", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:24:48Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993" }, { "reference_url": "https://github.com/advisories/GHSA-4hxr-28mv-q729", "reference_id": "GHSA-4hxr-28mv-q729", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4hxr-28mv-q729" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/372329?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u39", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qfdp-4b77-uqda" }, { "vulnerability": "VCID-wfhk-xspf-7yev" }, { "vulnerability": "VCID-xfq5-m4vf-cyaj" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u39" } ], "aliases": [ "CVE-2024-11993", "GHSA-4hxr-28mv-q729" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gngs-dm98-eqc2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210169?format=api", "vulnerability_id": "VCID-hkq7-mdbr-hkb2", "summary": "Liferay Portal and Liferay DXP Bypass via Double Encoded URL", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15840", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00194", "scoring_system": "epss", "scoring_elements": "0.41395", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00194", "scoring_system": "epss", "scoring_elements": "0.41229", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00194", "scoring_system": "epss", "scoring_elements": "0.41404", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00194", "scoring_system": "epss", "scoring_elements": "0.41413", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15840" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17046", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17046" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204" }, { "reference_url": "https://security.snyk.io/vuln/SNYK-JAVA-COMLIFERAYPORTAL-1296538", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMLIFERAYPORTAL-1296538" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15840", "reference_id": "CVE-2020-15840", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15840" }, { "reference_url": "https://github.com/advisories/GHSA-vrwx-q9pj-x488", "reference_id": "GHSA-vrwx-q9pj-x488", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vrwx-q9pj-x488" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2020-15840", "GHSA-vrwx-q9pj-x488" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hkq7-mdbr-hkb2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210633?format=api", "vulnerability_id": "VCID-hqd6-nkr9-4ffm", "summary": "Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29049", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00278", "scoring_system": "epss", "scoring_elements": "0.51653", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00278", "scoring_system": "epss", "scoring_elements": "0.51526", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00278", "scoring_system": "epss", "scoring_elements": "0.51656", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00278", "scoring_system": "epss", "scoring_elements": "0.51667", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29049" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17211", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17211" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29049", "reference_id": "CVE-2021-29049", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29049" }, { "reference_url": "https://github.com/advisories/GHSA-w28v-87g6-cjr6", "reference_id": "GHSA-w28v-87g6-cjr6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w28v-87g6-cjr6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19588?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp23" }, { "url": "http://public2.vulnerablecode.io/api/packages/541766?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp24", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp24" }, { "url": "http://public2.vulnerablecode.io/api/packages/23904?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp12" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29049", "GHSA-w28v-87g6-cjr6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hqd6-nkr9-4ffm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210477?format=api", "vulnerability_id": "VCID-jrqh-vfu7-dkfh", "summary": "Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33331", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00356", "scoring_system": "epss", "scoring_elements": "0.58399", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00356", "scoring_system": "epss", "scoring_elements": "0.58286", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00356", "scoring_system": "epss", "scoring_elements": "0.58403", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00356", "scoring_system": "epss", "scoring_elements": "0.58414", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33331" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17022", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17022" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33331", "reference_id": "CVE-2021-33331", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33331" }, { "reference_url": "https://github.com/advisories/GHSA-mj8w-h522-jwm8", "reference_id": "GHSA-mj8w-h522-jwm8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mj8w-h522-jwm8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/20299?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp8" } ], "aliases": [ "CVE-2021-33331", "GHSA-mj8w-h522-jwm8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jrqh-vfu7-dkfh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210497?format=api", "vulnerability_id": "VCID-jxe5-tt8r-cbag", "summary": "Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33338", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.29217", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.29013", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.29224", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0011", "scoring_system": "epss", "scoring_elements": "0.29235", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33338" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17030", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17030" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33338", "reference_id": "CVE-2021-33338", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33338" }, { "reference_url": "https://github.com/advisories/GHSA-4frg-rpx6-96qh", "reference_id": "GHSA-4frg-rpx6-96qh", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4frg-rpx6-96qh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/19214?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp6" } ], "aliases": [ "CVE-2021-33338", "GHSA-4frg-rpx6-96qh" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jxe5-tt8r-cbag" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/32590?format=api", "vulnerability_id": "VCID-k469-ety8-rqby", "summary": "The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25605", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40276", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40456", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40444", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00186", "scoring_system": "epss", "scoring_elements": "0.40467", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25605" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/45ffb97de7ac475335215f2b6e86ebe1e7283ab4" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/5eb426ecc49e036ad566e829b8a2132104f7130e" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605", "reference_id": "cve-2024-25605", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-20T16:21:08Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25605", "reference_id": "CVE-2024-25605", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25605" }, { "reference_url": "https://github.com/advisories/GHSA-mf8h-grfg-j9j3", "reference_id": "GHSA-mf8h-grfg-j9j3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mf8h-grfg-j9j3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27872?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17" } ], "aliases": [ "CVE-2024-25605", "GHSA-mf8h-grfg-j9j3" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k469-ety8-rqby" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/323137?format=api", "vulnerability_id": "VCID-k644-swhk-k7b1", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15841", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00337", "scoring_system": "epss", "scoring_elements": "0.5691", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00337", "scoring_system": "epss", "scoring_elements": "0.57031", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00337", "scoring_system": "epss", "scoring_elements": "0.57045", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00337", "scoring_system": "epss", "scoring_elements": "0.57037", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15841" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-16928", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-16928" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15841", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15841" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439" }, { "reference_url": "https://github.com/advisories/GHSA-773f-f929-qgjj", "reference_id": "GHSA-773f-f929-qgjj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-773f-f929-qgjj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19215?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cdmw-ujbw-yqbj" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp17" }, { "url": "http://public2.vulnerablecode.io/api/packages/384994?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-b4t3-pryv-x3a7" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cdmw-ujbw-yqbj" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qcxr-ayvy-z3h2" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp4" } ], "aliases": [ "CVE-2020-15841", "GHSA-773f-f929-qgjj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k644-swhk-k7b1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/356697?format=api", "vulnerability_id": "VCID-kpwb-z5k7-bqa8", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-42628", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00159", "scoring_system": "epss", "scoring_elements": "0.36604", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00159", "scoring_system": "epss", "scoring_elements": "0.36783", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00159", "scoring_system": "epss", "scoring_elements": "0.36808", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00159", "scoring_system": "epss", "scoring_elements": "0.36797", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-42628" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42628", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42628" }, { "reference_url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.0", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal" }, { "reference_url": "https://github.com/advisories/GHSA-hv45-r2f5-fmhj", "reference_id": "GHSA-hv45-r2f5-fmhj", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hv45-r2f5-fmhj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/541767?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/541775?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/29237?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u34", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u34" }, { "url": "http://public2.vulnerablecode.io/api/packages/372312?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u88", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-huvy-gpy3-v3dp" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n512-h3fa-xbh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u88" } ], "aliases": [ "CVE-2023-42628", "GHSA-hv45-r2f5-fmhj" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kpwb-z5k7-bqa8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/32565?format=api", "vulnerability_id": "VCID-mqut-n4an-x3cs", "summary": "Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25150", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00172", "scoring_system": "epss", "scoring_elements": "0.38669", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00172", "scoring_system": "epss", "scoring_elements": "0.38659", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00172", "scoring_system": "epss", "scoring_elements": "0.38474", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00172", "scoring_system": "epss", "scoring_elements": "0.38647", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25150" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150", "reference_id": "cve-2024-25150", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-20T14:56:08Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25150", "reference_id": "CVE-2024-25150", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25150" }, { "reference_url": "https://github.com/advisories/GHSA-4585-28v2-8h46", "reference_id": "GHSA-4585-28v2-8h46", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4585-28v2-8h46" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27467?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/27874?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u4" } ], "aliases": [ "CVE-2024-25150", "GHSA-4585-28v2-8h46" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mqut-n4an-x3cs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210485?format=api", "vulnerability_id": "VCID-msx1-y2nc-n7gt", "summary": "Liferay Portal and Liferay DXP autosaves form data for other users to see", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33323", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.62307", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.62205", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.62313", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00417", "scoring_system": "epss", "scoring_elements": "0.62318", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33323" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17049", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17049" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33323", "reference_id": "CVE-2021-33323", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33323" }, { "reference_url": "https://github.com/advisories/GHSA-fxpf-jr2q-vpvv", "reference_id": "GHSA-fxpf-jr2q-vpvv", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fxpf-jr2q-vpvv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2021-33323", "GHSA-fxpf-jr2q-vpvv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-msx1-y2nc-n7gt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210483?format=api", "vulnerability_id": "VCID-n4t4-bb8c-nub4", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33328", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00148", "scoring_system": "epss", "scoring_elements": "0.35219", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00148", "scoring_system": "epss", "scoring_elements": "0.35041", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00148", "scoring_system": "epss", "scoring_elements": "0.3522", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00148", "scoring_system": "epss", "scoring_elements": "0.35243", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33328" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17100", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17100" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33328", "reference_id": "CVE-2021-33328", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33328" }, { "reference_url": "https://github.com/advisories/GHSA-vpvm-3wfw-5f5c", "reference_id": "GHSA-vpvm-3wfw-5f5c", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vpvm-3wfw-5f5c" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/23551?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9" } ], "aliases": [ "CVE-2021-33328", "GHSA-vpvm-3wfw-5f5c" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n4t4-bb8c-nub4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/32282?format=api", "vulnerability_id": "VCID-n634-fspx-judk", "summary": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25149", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49567", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.4971", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49722", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49703", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-25149" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/dfd287acb325e2cddced3910e3baba1d258509de" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149", "reference_id": "cve-2024-25149", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-22T17:46:50Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25149", "reference_id": "CVE-2024-25149", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25149" }, { "reference_url": "https://github.com/advisories/GHSA-qpgh-6v9w-vfv6", "reference_id": "GHSA-qpgh-6v9w-vfv6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qpgh-6v9w-vfv6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27023?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15" } ], "aliases": [ "CVE-2024-25149", "GHSA-qpgh-6v9w-vfv6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n634-fspx-judk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210412?format=api", "vulnerability_id": "VCID-p17t-h88p-zybu", "summary": "Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29041", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00507", "scoring_system": "epss", "scoring_elements": "0.66731", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00507", "scoring_system": "epss", "scoring_elements": "0.66837", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00507", "scoring_system": "epss", "scoring_elements": "0.66838", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00507", "scoring_system": "epss", "scoring_elements": "0.66824", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29041" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17131", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17131" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29041", "reference_id": "CVE-2021-29041", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29041" }, { "reference_url": "https://github.com/advisories/GHSA-82j7-2h3j-hc7f", "reference_id": "GHSA-82j7-2h3j-hc7f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-82j7-2h3j-hc7f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29041", "GHSA-82j7-2h3j-hc7f" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p17t-h88p-zybu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210419?format=api", "vulnerability_id": "VCID-qaj9-m3df-7qbr", "summary": "Liferay Portal and Liferay DXP Fails to Check Permissions", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29052", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27774", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27557", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27759", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27784", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29052" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29052", "reference_id": "CVE-2021-29052", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29052" }, { "reference_url": "https://github.com/advisories/GHSA-pr7v-qv65-rp9m", "reference_id": "GHSA-pr7v-qv65-rp9m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pr7v-qv65-rp9m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29052", "GHSA-pr7v-qv65-rp9m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qaj9-m3df-7qbr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/323138?format=api", "vulnerability_id": "VCID-qcxr-ayvy-z3h2", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15842", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0057", "scoring_system": "epss", "scoring_elements": "0.69067", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0057", "scoring_system": "epss", "scoring_elements": "0.69159", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0057", "scoring_system": "epss", "scoring_elements": "0.69171", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0057", "scoring_system": "epss", "scoring_elements": "0.69165", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-15842" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-16963", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-16963" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15842", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15842" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427" }, { "reference_url": "https://github.com/advisories/GHSA-mg3r-9jh8-33r9", "reference_id": "GHSA-mg3r-9jh8-33r9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mg3r-9jh8-33r9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19215?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cdmw-ujbw-yqbj" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp17" }, { "url": "http://public2.vulnerablecode.io/api/packages/19213?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-4qnf-vd8e-9yfr" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-6ejn-7nds-1qb6" }, { "vulnerability": "VCID-6gyp-c7wt-qfb5" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9bfa-6qqd-d7gb" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b12f-kdez-2qau" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-dy73-grbk-tyb6" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-fx8b-2pzj-uyg6" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hkq7-mdbr-hkb2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-jxe5-tt8r-cbag" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-msx1-y2nc-n7gt" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-yxjx-p7zs-3fec" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp5" } ], "aliases": [ "CVE-2020-15842", "GHSA-mg3r-9jh8-33r9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qcxr-ayvy-z3h2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208325?format=api", "vulnerability_id": "VCID-scdp-ugfr-yqap", "summary": "Liferay Portal and Liferay DXP has incorrect default permissions for site members", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38268", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00119", "scoring_system": "epss", "scoring_elements": "0.30657", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00119", "scoring_system": "epss", "scoring_elements": "0.30461", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00119", "scoring_system": "epss", "scoring_elements": "0.30662", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00119", "scoring_system": "epss", "scoring_elements": "0.30676", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38268" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/16228425d7395b564f3c4cb5fae0c71c7228202b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/16228425d7395b564f3c4cb5fae0c71c7228202b" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17150", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17150" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38268-site-member-can-add-new-forms-by-default?p_r_p_assetEntryId=121611813&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611813%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38268-site-member-can-add-new-forms-by-default?p_r_p_assetEntryId=121611813&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611813%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38268", "reference_id": "CVE-2021-38268", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38268" }, { "reference_url": "https://github.com/advisories/GHSA-f855-2rvm-5j7h", "reference_id": "GHSA-f855-2rvm-5j7h", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f855-2rvm-5j7h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19556?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21" }, { "url": "http://public2.vulnerablecode.io/api/packages/541053?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22" }, { "url": "http://public2.vulnerablecode.io/api/packages/19552?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10" }, { "url": "http://public2.vulnerablecode.io/api/packages/19559?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-z611-svpn-m7b1" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp2" } ], "aliases": [ "CVE-2021-38268", "GHSA-f855-2rvm-5j7h" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-scdp-ugfr-yqap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/165509?format=api", "vulnerability_id": "VCID-shuw-qkwq-vygb", "summary": "Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28978", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.30682", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.30481", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.30677", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0012", "scoring_system": "epss", "scoring_elements": "0.30697", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-28978" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/ffdc9d1f8abf484598afdc51671a30533740c16d", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/ffdc9d1f8abf484598afdc51671a30533740c16d" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17332", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17332" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership?p_r_p_assetEntryId=121612301&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612301%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership?p_r_p_assetEntryId=121612301&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612301%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28978", "reference_id": "CVE-2022-28978", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28978" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership", "reference_id": "cve-2022-28978-stored-xss-with-user-name-in-site-membership", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:52:15Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership" }, { "reference_url": "https://web.archive.org/web/20220922015759/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership", "reference_id": "CVE-2022-28978-STORED-XSS-WITH-USER-NAME-IN-SITE-MEMBERSHIP", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20220922015759/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership" }, { "reference_url": "https://github.com/advisories/GHSA-7m65-hmvg-rxpc", "reference_id": "GHSA-7m65-hmvg-rxpc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7m65-hmvg-rxpc" }, { "reference_url": "http://liferay.com", "reference_id": "liferay.com", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-27T18:52:15Z/" } ], "url": "http://liferay.com" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27009?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp26" }, { "url": "http://public2.vulnerablecode.io/api/packages/27023?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15" } ], "aliases": [ "CVE-2022-28978", "GHSA-7m65-hmvg-rxpc" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-shuw-qkwq-vygb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210490?format=api", "vulnerability_id": "VCID-t45b-p6e7-j7ev", "summary": "Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33326", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.62341", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.62239", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.62349", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00418", "scoring_system": "epss", "scoring_elements": "0.62353", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33326" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/eb0590cea2d899f9e95bdb2e767466b8444aa573", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/eb0590cea2d899f9e95bdb2e767466b8444aa573" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17093", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17093" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33326-xss-with-the-title-of-a-modal-window?p_r_p_assetEntryId=121610771&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610771%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33326-xss-with-the-title-of-a-modal-window?p_r_p_assetEntryId=121610771&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610771%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33326", "reference_id": "CVE-2021-33326", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33326" }, { "reference_url": "https://github.com/advisories/GHSA-hgjv-7wjr-qwqp", "reference_id": "GHSA-hgjv-7wjr-qwqp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hgjv-7wjr-qwqp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/23551?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9" } ], "aliases": [ "CVE-2021-33326", "GHSA-hgjv-7wjr-qwqp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t45b-p6e7-j7ev" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210423?format=api", "vulnerability_id": "VCID-t5h8-q4q5-a3em", "summary": "Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29053", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00449", "scoring_system": "epss", "scoring_elements": "0.64151", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00449", "scoring_system": "epss", "scoring_elements": "0.64038", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00449", "scoring_system": "epss", "scoring_elements": "0.64141", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00449", "scoring_system": "epss", "scoring_elements": "0.64154", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29053" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://web.archive.org/web/20221121171927/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20221121171927/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29053", "reference_id": "CVE-2021-29053", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29053" }, { "reference_url": "https://github.com/advisories/GHSA-f9wj-c5pc-g9rh", "reference_id": "GHSA-f9wj-c5pc-g9rh", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f9wj-c5pc-g9rh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29053", "GHSA-f9wj-c5pc-g9rh" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t5h8-q4q5-a3em" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208342?format=api", "vulnerability_id": "VCID-tvcx-nbr1-efc2", "summary": "Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38269", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39345", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39174", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39358", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.3937", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38269" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/0b28a0d0ca7592660c66c15aa14fe709b7c0c141", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/0b28a0d0ca7592660c66c15aa14fe709b7c0c141" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17203", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17203" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38269-stored-xss-with-gogo-shell-output?p_r_p_assetEntryId=121611883&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611883%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38269-stored-xss-with-gogo-shell-output?p_r_p_assetEntryId=121611883&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611883%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38269", "reference_id": "CVE-2021-38269", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38269" }, { "reference_url": "https://github.com/advisories/GHSA-vw6g-gh6c-8qwp", "reference_id": "GHSA-vw6g-gh6c-8qwp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vw6g-gh6c-8qwp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19588?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp23" }, { "url": "http://public2.vulnerablecode.io/api/packages/541766?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp24", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp24" }, { "url": "http://public2.vulnerablecode.io/api/packages/19583?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp13" }, { "url": "http://public2.vulnerablecode.io/api/packages/19559?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-z611-svpn-m7b1" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp2" } ], "aliases": [ "CVE-2021-38269", "GHSA-vw6g-gh6c-8qwp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tvcx-nbr1-efc2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210420?format=api", "vulnerability_id": "VCID-v9m5-8c56-tuhb", "summary": "Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29043", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42768", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42597", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42759", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00204", "scoring_system": "epss", "scoring_elements": "0.42778", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-29043" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515" }, { "reference_url": "https://web.archive.org/web/20210517183617/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210517183617/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29043", "reference_id": "CVE-2021-29043", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29043" }, { "reference_url": "https://github.com/advisories/GHSA-xx2h-2hf5-v7vv", "reference_id": "GHSA-xx2h-2hf5-v7vv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xx2h-2hf5-v7vv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19556?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp21" }, { "url": "http://public2.vulnerablecode.io/api/packages/541053?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp22" }, { "url": "http://public2.vulnerablecode.io/api/packages/19552?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp10" }, { "url": "http://public2.vulnerablecode.io/api/packages/23359?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-evf7-f2j5-rqhr" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.fp1" } ], "aliases": [ "CVE-2021-29043", "GHSA-xx2h-2hf5-v7vv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v9m5-8c56-tuhb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208347?format=api", "vulnerability_id": "VCID-vk9f-1396-jkcp", "summary": "Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38265", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39345", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39174", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.39358", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00178", "scoring_system": "epss", "scoring_elements": "0.3937", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38265" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/ac8267406785c2e70f4b15aadd604fbe7fb4451b", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/ac8267406785c2e70f4b15aadd604fbe7fb4451b" }, { "reference_url": "https://liferay.atlassian.net/browse/LPE-17229", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.atlassian.net/browse/LPE-17229" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38265-stored-xss-with-collection-name?p_r_p_assetEntryId=121611955&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611955%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38265-stored-xss-with-collection-name?p_r_p_assetEntryId=121611955&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611955%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38265", "reference_id": "CVE-2021-38265", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38265" }, { "reference_url": "https://github.com/advisories/GHSA-3x83-whxw-pvmg", "reference_id": "GHSA-3x83-whxw-pvmg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3x83-whxw-pvmg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/541054?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10" } ], "aliases": [ "CVE-2021-38265", "GHSA-3x83-whxw-pvmg" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vk9f-1396-jkcp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208352?format=api", "vulnerability_id": "VCID-vweb-9s62-zucm", "summary": "Liferay Portal and Liferay DXP fails to properly import users from LDAP", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38266", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01851", "scoring_system": "epss", "scoring_elements": "0.83477", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01851", "scoring_system": "epss", "scoring_elements": "0.83417", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01851", "scoring_system": "epss", "scoring_elements": "0.83483", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01851", "scoring_system": "epss", "scoring_elements": "0.83486", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38266" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17191", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17191" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611673%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611673%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38266", "reference_id": "CVE-2021-38266", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38266" }, { "reference_url": "https://github.com/advisories/GHSA-jp3m-vh3g-6ggp", "reference_id": "GHSA-jp3m-vh3g-6ggp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jp3m-vh3g-6ggp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19595?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.0-ga1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.0-ga1" }, { "url": "http://public2.vulnerablecode.io/api/packages/541054?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-8uqz-bc88-ybcc" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9ka7-ck9s-nudp" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-b31e-vxh7-1qe8" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-h9vv-1cu6-jydx" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-j1vh-25uj-ukga" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-kqhp-785u-nben" }, { "vulnerability": "VCID-kqsk-3dby-s3dh" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n512-h3fa-xbh7" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-txpn-fzyb-3udy" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10" } ], "aliases": [ "CVE-2021-38266", "GHSA-jp3m-vh3g-6ggp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vweb-9s62-zucm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/166289?format=api", "vulnerability_id": "VCID-vwmh-2kxm-bkan", "summary": "A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42118", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.32426", "scoring_system": "epss", "scoring_elements": "0.96967", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.52265", "scoring_system": "epss", "scoring_elements": "0.97988", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.52265", "scoring_system": "epss", "scoring_elements": "0.97989", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.52265", "scoring_system": "epss", "scoring_elements": "0.9799", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42118" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/b42f1e70a69a31a3f2f7004a5b1923ec1e1e5445", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/b42f1e70a69a31a3f2f7004a5b1923ec1e1e5445" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42118?p_r_p_assetEntryId=121613298&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613298%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42118?p_r_p_assetEntryId=121613298&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613298%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118", "reference_id": "cve-2022-42118", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:37:48Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42118", "reference_id": "CVE-2022-42118", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42118" }, { "reference_url": "https://github.com/advisories/GHSA-mr77-4pm4-x9vm", "reference_id": "GHSA-mr77-4pm4-x9vm", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mr77-4pm4-x9vm" }, { "reference_url": "http://liferay.com", "reference_id": "liferay.com", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:37:48Z/" } ], "url": "http://liferay.com" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17342", "reference_id": "LPE-17342", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T14:37:48Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17342" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27860?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27" }, { "url": "http://public2.vulnerablecode.io/api/packages/27023?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp15" } ], "aliases": [ "CVE-2022-42118", "GHSA-mr77-4pm4-x9vm" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vwmh-2kxm-bkan" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210501?format=api", "vulnerability_id": "VCID-ww6r-hc6t-eqgp", "summary": "Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33335", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00634", "scoring_system": "epss", "scoring_elements": "0.70964", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00634", "scoring_system": "epss", "scoring_elements": "0.70873", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00634", "scoring_system": "epss", "scoring_elements": "0.70973", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00634", "scoring_system": "epss", "scoring_elements": "0.70976", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33335" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17103", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17103" }, { "reference_url": "https://web.archive.org/web/20220828222916/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20220828222916/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33335", "reference_id": "CVE-2021-33335", "reference_type": "", "scores": [ { "value": "7.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33335" }, { "reference_url": "https://github.com/advisories/GHSA-5gh9-g62h-f35m", "reference_id": "GHSA-5gh9-g62h-f35m", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5gh9-g62h-f35m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23361?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp20" }, { "url": "http://public2.vulnerablecode.io/api/packages/23551?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp9" } ], "aliases": [ "CVE-2021-33335", "GHSA-5gh9-g62h-f35m" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ww6r-hc6t-eqgp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/166518?format=api", "vulnerability_id": "VCID-xxcp-sye1-tfbz", "summary": "A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42110", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65269", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65378", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.6538", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65369", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42110" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://github.com/liferay/liferay-portal/commit/99b1c4752cd06e6681d7aa9c3b0f58154f434060", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal/commit/99b1c4752cd06e6681d7aa9c3b0f58154f434060" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42110?p_r_p_assetEntryId=121612856&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612856%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42110?p_r_p_assetEntryId=121612856&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612856%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110", "reference_id": "cve-2022-42110", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:52:12Z/" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42110", "reference_id": "CVE-2022-42110", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42110" }, { "reference_url": "https://github.com/advisories/GHSA-2qwm-9mg5-jwq8", "reference_id": "GHSA-2qwm-9mg5-jwq8", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2qwm-9mg5-jwq8" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17403", "reference_id": "LPE-17403", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T18:52:12Z/" } ], "url": "https://issues.liferay.com/browse/LPE-17403" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27860?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp27" }, { "url": "http://public2.vulnerablecode.io/api/packages/27872?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-uxjd-h6fd-sbgf" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp17" } ], "aliases": [ "CVE-2022-42110", "GHSA-2qwm-9mg5-jwq8" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xxcp-sye1-tfbz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/210478?format=api", "vulnerability_id": "VCID-yxjx-p7zs-3fec", "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33332", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00146", "scoring_system": "epss", "scoring_elements": "0.34944", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00146", "scoring_system": "epss", "scoring_elements": "0.34766", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00146", "scoring_system": "epss", "scoring_elements": "0.34946", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00146", "scoring_system": "epss", "scoring_elements": "0.34967", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-33332" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://issues.liferay.com/browse/LPE-17053", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://issues.liferay.com/browse/LPE-17053" }, { "reference_url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33332", "reference_id": "CVE-2021-33332", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33332" }, { "reference_url": "https://github.com/advisories/GHSA-9995-qvcg-x7g6", "reference_id": "GHSA-9995-qvcg-x7g6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-9995-qvcg-x7g6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20298?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gd6-wm47-ufad" }, { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-fer2-q3rr-2khd" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp19" }, { "url": "http://public2.vulnerablecode.io/api/packages/22460?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1k1u-jptu-n3d7" }, { "vulnerability": "VCID-25ay-9z7s-47dg" }, { "vulnerability": "VCID-48hp-m4m8-cqge" }, { "vulnerability": "VCID-5gqq-m36a-53b6" }, { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-72my-1zwg-a7hx" }, { "vulnerability": "VCID-76r8-wfvh-pkg4" }, { "vulnerability": "VCID-88u7-stft-ebdh" }, { "vulnerability": "VCID-91rc-5gz3-dbcf" }, { "vulnerability": "VCID-9u32-4n1x-77ce" }, { "vulnerability": "VCID-9xdb-721c-hqgf" }, { "vulnerability": "VCID-a62g-s5j4-73fr" }, { "vulnerability": "VCID-ank8-p9qa-9udx" }, { "vulnerability": "VCID-bmbd-g58w-z3gy" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-ckbc-n5n3-dka6" }, { "vulnerability": "VCID-cn4z-f8ej-ruha" }, { "vulnerability": "VCID-ed9v-m3q5-6yaq" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-g52h-8r1h-dfhe" }, { "vulnerability": "VCID-g6wt-vwuh-cua8" }, { "vulnerability": "VCID-gkpd-2p17-7fcq" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-hqd6-nkr9-4ffm" }, { "vulnerability": "VCID-jjec-4x7z-ayhz" }, { "vulnerability": "VCID-jrqh-vfu7-dkfh" }, { "vulnerability": "VCID-k469-ety8-rqby" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-mjr1-fwsd-xkgc" }, { "vulnerability": "VCID-mqut-n4an-x3cs" }, { "vulnerability": "VCID-n4t4-bb8c-nub4" }, { "vulnerability": "VCID-n634-fspx-judk" }, { "vulnerability": "VCID-p17t-h88p-zybu" }, { "vulnerability": "VCID-qaj9-m3df-7qbr" }, { "vulnerability": "VCID-qztv-899y-sbb8" }, { "vulnerability": "VCID-scdp-ugfr-yqap" }, { "vulnerability": "VCID-shuw-qkwq-vygb" }, { "vulnerability": "VCID-snty-bgwf-33bu" }, { "vulnerability": "VCID-t45b-p6e7-j7ev" }, { "vulnerability": "VCID-t5h8-q4q5-a3em" }, { "vulnerability": "VCID-tgpb-tps9-wfd5" }, { "vulnerability": "VCID-tvcx-nbr1-efc2" }, { "vulnerability": "VCID-umd8-9ypn-zkdk" }, { "vulnerability": "VCID-v9m5-8c56-tuhb" }, { "vulnerability": "VCID-vk9f-1396-jkcp" }, { "vulnerability": "VCID-vweb-9s62-zucm" }, { "vulnerability": "VCID-vwmh-2kxm-bkan" }, { "vulnerability": "VCID-way6-hfht-aya6" }, { "vulnerability": "VCID-ww6r-hc6t-eqgp" }, { "vulnerability": "VCID-xxcp-sye1-tfbz" }, { "vulnerability": "VCID-yffn-r39p-nfcp" }, { "vulnerability": "VCID-zkm4-bz55-9bb8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.2.10.fp7" } ], "aliases": [ "CVE-2021-33332", "GHSA-9995-qvcg-x7g6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yxjx-p7zs-3fec" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/138648?format=api", "vulnerability_id": "VCID-zkm4-bz55-9bb8", "summary": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-37940", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38976", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.3899", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38804", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38999", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-37940" }, { "reference_url": "https://github.com/liferay/liferay-portal", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/liferay/liferay-portal" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940" }, { "reference_url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940", "reference_id": "CVE-2023-37940", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-17T21:41:20Z/" } ], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940" }, { "reference_url": "https://github.com/advisories/GHSA-px38-239g-x5mg", "reference_id": "GHSA-px38-239g-x5mg", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-px38-239g-x5mg" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/372311?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u30", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6aqp-gny4-5ffp" }, { "vulnerability": "VCID-bvbr-288p-xkak" }, { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-gngs-dm98-eqc2" }, { "vulnerability": "VCID-kpwb-z5k7-bqa8" }, { "vulnerability": "VCID-n512-h3fa-xbh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.3.10.u30" }, { "url": "http://public2.vulnerablecode.io/api/packages/372312?format=api", "purl": "pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u88", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-epds-vwku-cyed" }, { "vulnerability": "VCID-huvy-gpy3-v3dp" }, { "vulnerability": "VCID-mmy3-eycu-q7bu" }, { "vulnerability": "VCID-n512-h3fa-xbh7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.4.13.u88" } ], "aliases": [ "CVE-2023-37940", "GHSA-px38-239g-x5mg" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zkm4-bz55-9bb8" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/com.liferay.portal/release.dxp.bom@7.1.10.fp10" }