DeutschShown in its original language — a full translation is planned for a future version.
Liferay Portal und DXP: Mehrere Schwachstellen
view advisory published 2024-02-19
Ein entfernter Angreifer kann mehrere Schwachstellen in Liferay Liferay DXP und Liferay Liferay Portal ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder seine Privilegien zu erweitern.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-25608US | medium6.1 | — | ||
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19,… | ||||
| CVE-2024-25607US | high7.5 | — | ||
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before… | ||||
| CVE-2024-25606US | high8.7 | — | ||
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and ol… | ||||
| CVE-2024-25605US | medium5.3OT elevated | — | ||
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older uns… | ||||
| CVE-2024-25604US | medium6.5OT elevated | — | ||
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does… | ||||
| CVE-2024-25150US | medium4.3 | — | ||
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix… | ||||
| CVE-2024-25149US | medium5.4OT elevated | — | ||
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not prope… | ||||
| CVE-2023-44308US | medium6.1 | — | ||
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to a… | ||||
| CVE-2023-5190US | medium6.1 | — | ||
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 t… | ||||
02
references
External citations — patches, advisories, analysis.
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
- Liferay Known Vulnerabilities vom 2024-02-19external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan