WaratekVRT Sign in

CVE-2024-25606

Severity8.7 High CVSS 3.1 2 scores
Fixed in14.0.0
WeaknessXML external entity (XXE) (CWE-611)
Published20 Feb 2024
Updated17 Jun 2026

Description

XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.50% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full XXE
  • Action available security rule
  • Review automated Inferred
  • Record active
Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR xxe security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-611: XML External Entity Reference.

How to mitigate CVE-2024-25606

Upgrade the affected software to 14.0.0 or later. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

8.7 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.7 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H NVD Primary published
CVSS 3.1 8.0 HIGH CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H security@liferay.com Secondary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.liferay.portal:com.liferay.util.java 0 14.0.0 unbounded
com.liferay.portal:release.portal.bom 0 7.4.3.8 unbounded
com.liferay.portal:release.dxp.bom 7.3.0 7.3.10.u12 unbounded
com.liferay.portal:release.dxp.bom 7.4.0 7.4.13.u4 unbounded
com.liferay.portal:release.dxp.bom 0 7.2.10.fp20 unbounded

Products and versions

5 products, 51 version entries
SourceVendorProductSchemeAffected versions
osv com.liferay.portal com.liferay.util.java generic ＜ 14.0.0
osv com.liferay.portal release.dxp.bom generic ＜ 7.2.10.20 · ≥ 7.3.0 and ＜ 7.3.10.12 · ≥ 7.4.0 and ＜ 7.4.13.4
osv com.liferay.portal release.portal.bom generic ＜ 7.4.3.8
nvd liferay digital experience platform generic 7.2 · ＜ 7.2 · 7.2:fix_pack_1 · 7.2:service_pack_1 · 7.2:fix_pack_2 · 7.2:service_pack_2 · 7.2:fix_pack_3 · 7.2:service_pack_3 · 7.2:fix_pack_4 · 7.2:service_pack_4 · 7.2:fix_pack_5 · 7.2:service_pack_5 · 7.2:fix_pack_6 · 7.2:service_pack_6 · 7.2:fix_pack_7 · 7.2:service_pack_7 · 7.2:fix_pack_8 · 7.2:fix_pack_9 · 7.2:fix_pack_10 · 7.2:fix_pack_11 · 7.2:fix_pack_12 · 7.2:fix_pack_13 · 7.2:fix_pack_14 · 7.2:fix_pack_15 · 7.2:fix_pack_16 · 7.2:fix_pack_17 · 7.2:fix_pack_18 · 7.2:fix_pack_19 · 7.3 · 7.3:fix_pack_1 · 7.3:service_pack_1 · 7.3:fix_pack_2 · 7.3:service_pack_3 · 7.3:update4 · 7.3:update5 · 7.3:update6 · 7.3:update7 · 7.3:update8 · 7.3:update9 · 7.3:update10 · 7.3:update11 · 7.4 · 7.4:update1 · 7.4:update2 · 7.4:update3
nvd liferay liferay portal generic ＜ 7.4.3.8

References

URLTags
https://github.com/liferay/liferay-portal PACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606 WEB

Timeline
Published2024-02-20By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.