deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m55r-9fx8-725j
Package: com.liferay:com.liferay.configuration.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 2.0.7, < 5.0.76
Patched in: 5.0.76

Summary: Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect

Details:
An open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter.

An open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter.

An open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.
GitHub Security Advisory: GHSA-q86r-gwqc-jx85
Package: com.liferay:com.liferay.comment.web (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.0.2, < 6.1.4
Patched in: 6.1.4

Summary: Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

Details:
JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies to get executed.
GitHub Security Advisory: GHSA-f3hf-r62c-mfrj
Package: com.liferay:com.liferay.portal.vulcan.impl (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 5.0.7, < 5.0.105
Patched in: 5.0.105

Summary: Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

Details:
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
GitHub Security Advisory: GHSA-f3hf-r62c-mfrj
Package: com.liferay:com.liferay.portal.vulcan.api (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 8.0.2, < 40.2.0
Patched in: 40.2.0

Summary: Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

Details:
Liferay Portal 7.4.0 through 7.4.3.101, and Liferay DXP 2023.Q3.0 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA though update 35 does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing queries that return a large number of objects.
GitHub Security Advisory: GHSA-v53g-736w-mgw4
Package: com.liferay:com.liferay.organizations.item.selector.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 4.0.2, < 4.0.22
Patched in: 4.0.22

Summary: Liferay Portal's Organization Selector exposes organization data to remote authenticated users

Details:
The Organization Selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
GitHub Security Advisory: GHSA-wr8m-5h2p-4432
Package: com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 5.0.1, < 5.0.48
Patched in: 5.0.48

Summary: Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name

Details:
An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API.
GitHub Security Advisory: GHSA-jhgr-j9cj-8j62
Package: com.liferay:com.liferay.frontend.editor.ckeditor.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.76, < 5.0.102
Patched in: 5.0.102

Summary: Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

Details:
A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.
GitHub Security Advisory: GHSA-fvp7-jj9m-3qpf
Package: com.liferay:com.liferay.headless.builder.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.0.32
Patched in: 1.0.32

Summary: Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

Details:
An Improper Access Control vulnerability in Liferay Portal  7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.
GitHub Security Advisory: GHSA-7v6m-28jr-rg84
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 7.0.0.Alpha1, < 7.0.0.CR1
Patched in: 7.0.0.CR1

Summary: Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language

Details:
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
GitHub Security Advisory: GHSA-7v6m-28jr-rg84
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 6.2.0.CR1
Patched in: 6.2.0.CR1

Summary: Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language

Details:
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
GitHub Security Advisory: GHSA-rmrm-75hp-phr2
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 6.0.19.Final
Patched in: 6.0.20.Final

Summary: Improper Input Validation in Hibernate Validator

Details:
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
GitHub Security Advisory: GHSA-rmrm-75hp-phr2
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.1.0.Final, <= 6.1.4.Final
Patched in: 6.1.5.Final

Summary: Improper Input Validation in Hibernate Validator

Details:
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
GitHub Security Advisory: GHSA-m8p2-495h-ccmh
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0.Alpha1, <= 6.0.17.Final
Patched in: 6.0.18.Final

Summary: The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

Details:
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
GitHub Security Advisory: GHSA-m8p2-495h-ccmh
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.1.0.Alpha1, < 6.1.0.Alpha6
Patched in: 6.1.0.Alpha6

Summary: The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

Details:
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
GitHub Security Advisory: GHSA-5wxc-3jfw-w94p
Package: com.liferay:com.liferay.object.service (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 1.0.197
Patched in: 1.0.197

Summary: Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

Details:
An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
GitHub Security Advisory: GHSA-4mv7-cq75-3qjm
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.51
Patched in: 1.51

Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Details:
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
GitHub Security Advisory: GHSA-r97x-3g8f-gx3m
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: >= 1.51, < 1.56
Patched in: 1.56

Summary: The Bouncy Castle JCE Provider carry a propagation bug

Details:
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
GitHub Security Advisory: GHSA-4vhj-98r6-424h
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 1.38, < 1.56
Patched in: 1.56

Summary: In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate

Details:
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
GitHub Security Advisory: GHSA-xqj7-j8j5-f2xr
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 1.60
Patched in: 1.60

Summary: Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator

Details:
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
GitHub Security Advisory: GHSA-w285-wf9q-5w69
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
GitHub Security Advisory: GHSA-fjqm-246c-mwqg
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: LOW (CVSS 3.7)
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: In Bouncy Castle JCE Provider the other party DH public key is not fully validated

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
GitHub Security Advisory: GHSA-9gp4-qrff-c648
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: MODERATE (CVSS 5.9)
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
GitHub Security Advisory: GHSA-2j2x-hx4g-2gf4
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-1310: Missing Ability to Patch ROM Code
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
GitHub Security Advisory: GHSA-rrvx-pwf8-p59p
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
GitHub Security Advisory: GHSA-r9ch-m4fh-fc7q
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: MODERATE (CVSS 5.9)
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
GitHub Security Advisory: GHSA-c8xf-m4ff-jcxj
Package: org.bouncycastle:bcprov-jdk15on (MAVEN)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: < 1.56
Patched in: 1.56

Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Details:
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
GitHub Security Advisory: GHSA-x83m-pf6f-pf9g
Package: org.hibernate:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.2.0.Final
Patched in: 6.2.0.Final

Summary: hibernate-validator Cross-site Scripting vulnerability

Details:
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.
GitHub Security Advisory: GHSA-88g3-pv3w-5wmr
Package: com.liferay:com.liferay.client.extension.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.0.71, < 2.0.27
Patched in: 2.0.27

Summary: Liferay Portal is vulnerable to XSS attacks via its remote app title field

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.
GitHub Security Advisory: GHSA-x5fw-8xgx-q6c9
Package: com.liferay:com.liferay.portal.search.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.125, < 6.0.143
Patched in: 6.0.143

Summary: Liferay Portal is vulnerable to XSS attack through its search bar portlet

Details:
A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet
GitHub Security Advisory: GHSA-9p7x-8c57-4pqv
Package: com.liferay:com.liferay.portal.workflow.api (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 7.0.1, < 11.0.1
Patched in: 11.0.1

Summary: Liferay Portal exposes ERC which can lead to exploit the time response attack

Details:
Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.
GitHub Security Advisory: GHSA-9p7x-8c57-4pqv
Package: com.liferay:com.liferay.headless.admin.workflow.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 5.0.4, < 5.0.83
Patched in: 5.0.83

Summary: Liferay Portal exposes ERC which can lead to exploit the time response attack

Details:
Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.
GitHub Security Advisory: GHSA-9p7x-8c57-4pqv
Package: com.liferay:com.liferay.portal.vulcan.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy, CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 5.0.7, < 5.0.127
Patched in: 5.0.127

Summary: Liferay Portal exposes ERC which can lead to exploit the time response attack

Details:
Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.
GitHub Security Advisory: GHSA-66x6-8jgv-qpfh
Package: com.liferay:com.liferay.portal.workflow.task.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.75
Patched in: 5.0.75

Summary: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Details:
A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.