CVE-2024-25606

{"id": "CVE-2024-25606", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@liferay.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2024-02-20T09:15:09.533", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606", "source": "security@liferay.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@liferay.com", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method."}, {"lang": "es", "value": "La vulnerabilidad XXE en Liferay Portal 7.2.0 a 7.4.3.7 y versiones anteriores no compatibles, y Liferay DXP 7.4 antes de la actualizaci\u00f3n 4, 7.3 antes de la actualizaci\u00f3n 12, 7.2 antes del fixpack 20 y versiones anteriores no compatibles permite a atacantes con permiso implementar widgets/portlets /extensiones para obtener informaci\u00f3n confidencial o consumir recursos del sistema a trav\u00e9s del m\u00e9todo Java2WsddTask._format."}], "lastModified": "2024-02-20T19:50:53.960", "sourceIdentifier": "security@liferay.com"}