Lucene search

Veracode Vulnerability DatabaseVERACODE:45560

HistoryFeb 21, 2024 - 9:30 a.m.

XML External Entity (XXE)

2024-02-2109:30:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xml external entity java2wsddtask sensitive information liferay portal

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

liferay portal vulnerable to XML External Entity (XXE). The vulnerability is due toJava2WsddTask._format method, which allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources.

CPENameOperatorVersion
release.portal.bomle7.2.1
release.portal.bomle7.4.3.7
release.portal.bomle7.3.7
release.dxp.bomle7.4.13.u3
release.dxp.bomle7.2.10.fp19
release.dxp.bomle7.3.10.u11
release.portal.bomle7.2.1
release.portal.bomle7.4.3.7
release.portal.bomle7.3.7
release.dxp.bomle7.4.13.u3

Name	Operator	Version
release.portal.bom	le	7.2.1
release.portal.bom	le	7.4.3.7
release.portal.bom	le	7.3.7
release.dxp.bom	le	7.4.13.u3
release.dxp.bom	le	7.2.10.fp19
release.dxp.bom	le	7.3.10.u11
release.portal.bom	le	7.2.1
release.portal.bom	le	7.4.3.7
release.portal.bom	le	7.3.7
release.dxp.bom	le	7.4.13.u3

Rows per page:

1-10 of 121

References

github.com/advisories/GHSA-869h-qhfx-w939

liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VERACODE:45560