CVE-2024-25606

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive...

CVE-2024-25606

XXE vulnerability in Liferay Portal and Liferay DXP tracked as CVE-2024-25606 affects multiple versions (Liferay Portal 7.2.0–7.4.3.7; DXP 7.2/7.3/7.4 with specific updates). The underlying issue is in the Java2WsddTask._format method, allowing an attacker with permission to deploy widgets/portle...