CVE-2024-25606 — XML External Entity (XXE) Injection in Digital Experience Platform

CWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
8.7HIGHNVD
CNA8.0
EPSS
0.1%
top 65.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedFeb 20

Description

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:HExploitability: 2.3 | Impact: 5.8

Affected Packages4 packages

▶NVDliferay/liferay_portal< 7.4.3.8
▶CVEListV5liferay/portal7.2.0 — 7.4.3.7
▶CVEListV5liferay/dxp7.4.13 — 7.4.13.u3+2

🔴Vulnerability Details

3
CVEList
CVE-2024-25606: XXE vulnerability in Liferay Portal 7↗2024-02-20
▶
OSV
Liferay Portal has an XXE vulnerability in Java2WsddTask._format↗2024-02-20
▶
GHSA
Liferay Portal has an XXE vulnerability in Java2WsddTask._format↗2024-02-20
▶
CVE-2024-25606 — XML External Entity (XXE) Injection | cvebase