Sign in
Deutsch English Español Polski
High

Liferay Portal has an XXE vulnerability in Java2WsddTask._format

  • Disclosed: 20.02.2024
  • Updated: 11.10.2026 12:21

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) com.liferay.portal:com.liferay.util.java < 14.0.0 14.0.0
Java / Kotlin (Maven) com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.u12, >= 7.4.0, < 7.4.13.u4, < 7.2.10.fp20 7.3.10.u12, 7.4.13.u4, 7.2.10.fp20
Java / Kotlin (Maven) com.liferay.portal:release.portal.bom < 7.4.3.8 7.4.3.8

References

CVSS score 8/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-611
Platform
Java / Kotlin (Maven)
Package
com.liferay.portal:com.liferay.util.java, com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom
Disclosed
20.02.2024
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-869h-qhfx-w939 - CC BY 4.0

Vulnerability history: com.liferay.portal:release.dxp.bom

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (125) in the archive
Total entries
125
First → latest
02.2022 09.2025
Without a fix
8
Exploited in attacks
0

Severity breakdown

  • Critical 24
  • High 19
  • Medium 82

Disclosures per year

Severity:
  1. Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
    Critical · 9.0 CVE-2024-38002 >= 2023.Q4.0, < 2023.Q4.6, >= 2023.Q3.1, < 2023.Q3.9, >= 7.3-ga, < 7.3.10.u36, >= 7.4-ga, < 7.4.13.u92 2023.Q4.6, 2023.Q3.9, 7.3.10.u36, 7.4.13.u92
  2. Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
    Critical · 9.6 CVE-2024-8980 >= 2023.Q3.1, < 2023.Q3.5, >= 7.0.0-GA, <= 7.0.10.fp102, >= 7.1.0-GA, <= 7.1.10.fp28, >= 7.2.0.GA, <= 7.2.10.fp20, >= 7.3.0-GA, < 7.3.10.u36, >= 7.4.0-GA, <= 7.4.13.u92 2023.Q3.5, 7.3.10.u36
  3. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget
    High · 8.8 CVE-2024-26271 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.3u32, < 7.3u37, >= 7.4u75, < 7.4u93 2023.Q4.3, 2023.Q3.6, 7.3u37, 7.4u93
  4. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
    High · 8.8 CVE-2024-26273 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.4.GA, < 7.4u93, >= 7.3u29, < 7.3u36 2023.Q4.3, 2023.Q3.6, 7.4u93, 7.3u36
  5. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor
    High · 8.8 CVE-2024-26272 >= 2023.Q4.0, < 2023.Q4.3, >= 2023.Q3.1, < 2023.Q3.6, >= 7.3.GA, < 7.3u36, >= 7.4.GA, < 7.4u93 2023.Q4.3, 2023.Q3.6, 7.3u36, 7.4u93
  6. Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2023-47795 >= 2023.Q3, < 2023.Q3.6, >= 7.4.13.u18, <= 7.4.13.u92 2023.Q3.6
  7. Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25603 >= 7.4.13.u1, <= 7.4.13.u102, >= 7.3.10.ep3, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  8. Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
    Critical · 9.6 CVE-2024-26269 >= 7.4.13.u1, < 7.4.13.u38, >= 7.3.10.ep3, < 7.3.10.u11, >= 7.2.0, < 7.2.10.fp20 7.4.13.u38, 7.3.10.u11, 7.2.10.fp20
  9. Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-26266 >= 7.4.13.u1, < 7.4.13.u10, >= 7.3.10.ep3, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.4.13.u10, 7.3.10.u4, 7.2.10.fp17
  10. Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.0 CVE-2023-40191 >= 2023.Q3, < 2023.Q3.6, >= 7.4.13.u44, <= 7.4.13.u92 2023.Q3.6
  11. Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.6 CVE-2023-42498 >= 2023.Q3, < 2023.Q3.5, >= 7.4.13.u4, <= 7.4.13.u92 2023.Q3.5
  12. Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
    Critical · 9.6 CVE-2023-42496 >= 7.4.10.ep1, <= 7.4.13.u92, >= 7.3.10.ep3, < 7.3.10.u34, >= 2023.Q3, < 2023.Q3.6 7.3.10.u34, 2023.Q3.6
  13. Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25601 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  14. Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25602 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  15. Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
    Critical · 9.0 CVE-2024-25152 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp17 7.3.10.u4, 7.2.10.fp17
  16. Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
    Critical · 9.6 CVE-2024-25147 >= 7.3.0, < 7.3.10.u4, >= 7.2.0, < 7.2.10.fp15 7.3.10.u4, 7.2.10.fp15
  17. Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
    High · 8.8 CVE-2021-29050 >= 7.2.0, < 7.2.10.fp11 7.2.10.fp11
  18. Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
    Critical · 9.0 CVE-2024-25610 >= 7.4.0, < 7.4.13.u9, >= 7.3.0, < 7.3.10.u4, < 7.2.10.fp19 7.4.13.u9, 7.3.10.u4, 7.2.10.fp19
  19. Liferay Portal defaults to a low work factor for the default password hashing algorithm
    High · 8.1 CVE-2024-25607 >= 7.3.0, < 7.3.10.u4, < 7.2.10.fp17, >= 7.4.0, < 7.4.13.u16 7.3.10.u4, 7.2.10.fp17, 7.4.13.u16
  20. Liferay Portal has an XXE vulnerability in Java2WsddTask._format this entry
    High · 8.0 CVE-2024-25606 >= 7.3.0, < 7.3.10.u12, >= 7.4.0, < 7.4.13.u4, < 7.2.10.fp20 7.3.10.u12, 7.4.13.u4, 7.2.10.fp20
Show more (20) Showing 20 of 43

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.