CVE-2024-25606
About
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
Rainforest analyst review
This Liferay flaw lets an XML parser be pointed at external entities, so a crafted document can pull in files or hammer backend resources during processing. The important qualifier is in the advisory itself: it takes an account with permission to deploy widgets, portlets, or extensions, which is a privileged capability, not something handed to ordinary users.
Because of that gate, plus an attack the vendor rates as difficult, this is not opportunistic-scanner territory. It reads as an insider or post-compromise escalation: someone who already holds deployment rights turning that into file disclosure or resource exhaustion. The blast radius is real, but the population of people who can pull the trigger is small by design.
We rank this below its 8.0 for most environments and lean on access review rather than emergency patching. The question we ask is who actually holds widget/extension-deploy permission on our Liferay estate, and whether that set is as small and trusted as it should be. Tightening that role limits this bug and a whole family of deploy-privilege abuses at once; patching then follows the normal cadence.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2024-25606?
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
How severe is CVE-2024-25606?
CVE-2024-25606 carries a CVSS 3.1 base score of 8, rated high. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 86 out of 100, in the critical band.
How is CVE-2024-25606 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H): attack vector Network, attack complexity High, privileges required High, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2024-25606?
Public advisories list the following as affected: digital experience platform, liferay portal. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-25606?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.