VYPR
← All advisories
High severity8.0NVD Advisory· Published Feb 20, 2024· Updated Jun 17, 2026

CVE-2024-25606

CVE-2024-25606

Description

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:com.liferay.util.javaMaven
< 14.0.014.0.0
com.liferay.portal:release.portal.bomMaven
< 7.4.3.87.4.3.8
com.liferay.portal:release.dxp.bomMaven
>= 7.3.0, < 7.3.10.u127.3.10.u12
com.liferay.portal:release.dxp.bomMaven
>= 7.4.0, < 7.4.13.u47.4.13.u4
com.liferay.portal:release.dxp.bomMaven
< 7.2.10.fp207.2.10.fp20

Affected products

51
  • Liferay/Digital Experience Platform45 versions
    cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 44 more
    • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: <7.2
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_18:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_19:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: <7.4.3.8
    • (no CPE)range: 7.2.0
  • ghsa-coords3 versions
    pkg:maven/com.liferay.portal/com.liferay.util.javapkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay.portal/release.portal.bom
    < 14.0.0+ 2 more
    • (no CPE)range: < 14.0.0
    • (no CPE)range: >= 7.3.0, < 7.3.10.u12
    • (no CPE)range: < 7.4.3.8
  • Liferay/DXPcpe-rescue
    Range: 7.4.13

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.