CVE-2024-25606: XEE
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask.format method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.2.10.fp20 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.4.13.u4 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.3.10.u12 - Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.8 - Upgrade
Upgrade
maven/com.liferay.portal:com.liferay.util.javato a version that resolves this vulnerability.Fixed in 14.0.0 - Upgrade
Upgrade
Liferay Portalto a version that resolves this vulnerability.Fixed in 7.4.3.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25606?
CVE-2024-25606 is considered a critical vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2024-25606?
To remediate CVE-2024-25606, upgrade Liferay Portal to versions 7.2.10.fp20, 7.3.10.u12, or 7.4.13.u4 or later.
Which versions of Liferay are affected by CVE-2024-25606?
CVE-2024-25606 affects Liferay Portal versions 7.2.0 through 7.4.3.7 and older unsupported versions.
What types of attacks does CVE-2024-25606 allow?
CVE-2024-25606 allows attackers withappropriate permissions to exploit XML External Entities (XXE) vulnerabilities.
Is there a patch available for CVE-2024-25606?
Yes, there are patches available for CVE-2024-25606 in the form of updated versions of Liferay Portal.