Description

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

Remediation

References

CVE-2024-25606

Related Vulnerabilities

WordPress Plugin Really Simple Share Cross-Site Request Forgery (2.9.9)

WordPress Plugin Feed Them Gallery Cross-Site Scripting (1.1.8)

WordPress Plugin Docket Cache-Object Cache Accelerator Cross-Site Scripting (21.08.01)

Ampache Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-47184)

WordPress Plugin StreamCast-Radio Player for WordPress Cross-Site Scripting (2.1)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities CWE-611 CVE-2024-25606