CVE-2024-25606
Liferay Portal has an XXE vulnerability in Java2WsddTask._format
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
CVE-2024-25606- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2024-0778
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
EUVD-2024-0778- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-869h-qhfx-w939
Liferay Portal has an XXE vulnerability in Java2WsddTask._format
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
GHSA-869h-qhfx-w939- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
CVE-2024-25606- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
CVE-2024-25606- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-869h-qhfx-w939
Liferay Portal has an XXE vulnerability in Java2WsddTask._format
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
- Record
GHSA-869h-qhfx-w939- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:com.liferay.util.javaMaven |
before 14.0.0 | 14.0.0 |
com.liferay.portal:release.portal.bomMaven |
before 7.4.3.8 | 7.4.3.8 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u12 | 7.3.10.u12 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u4 | 7.4.13.u4 |
com.liferay.portal:release.dxp.bomMaven |
before 7.2.10.fp20 | 7.2.10.fp20 |
com.liferay.portal:com.liferay.util.javaMaven |
before 14.0.0, plus listed versions 1.0.010.0.011.0.012.0.013.0.0 Show 45 moreShow less2.0.02.0.12.1.02.2.02.2.12.2.22.3.02.3.12.4.02.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.182.5.192.5.22.5.202.5.212.5.222.5.232.5.242.5.252.5.262.5.272.5.282.5.292.5.32.5.302.5.312.5.322.5.332.5.342.5.352.5.362.5.42.5.52.5.62.5.72.5.8 |
14.0.0 |
com.liferay.portal:release.portal.bomMaven |
before 7.4.3.8, plus listed versions 7.0.67.0.6-17.0.6-27.1.07.1.1 Show 27 moreShow less7.1.27.1.37.1.3-17.2.07.2.17.2.1-17.3.07.3.0-17.3.17.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.47.4.3.57.4.3.67.4.3.7 |
7.4.3.8 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u12, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp1 Show 9 moreShow less7.3.10.fp27.3.10.u107.3.10.u117.3.10.u47.3.10.u57.3.10.u67.3.10.u77.3.10.u87.3.10.u9 |
7.3.10.u12 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0 up to 7.4.13.u4, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u17.4.13.u27.4.13.u3 |
7.4.13.u4 |
com.liferay.portal:release.dxp.bomMaven |
before 7.2.10.fp20, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 |
7.2.10.fp20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25606 is a high vulnerability (CVSS 8.0) in Liferay Dxp, published February 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in com.liferay.portal:com.liferay.util.java 14.0.0.
References
Left out here: 170 versions. The JSON record has them.