com.liferay.portal:release.dxp.bom Security Analysis
com.liferay.portal:release.dxp.bom has 24 known security vulnerabilities in Maven (Java). Upgrade to version 2023.Q4.6 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 2023.Q4.6
Upgrading to 2023.Q4.6 or later resolves all 24 known vulnerabilities in com.liferay.portal:release.dxp.bom. Update your pom.xml or build.gradle to version 2023.Q4.6.
Is com.liferay.portal:release.dxp.bom in your project?
Check if you're affected and upgrade to 2023.Q4.6 to stay secure.
Vulnerabilities
24 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2024-8980 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console | CRITICAL | 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4 (+230 more) | 2023.Q3.5, 7.3.10.u36 |
| CVE-2024-26269 Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting | CRITICAL | 7.4.13.u1, 7.4.13.u10, 7.4.13.u15, 7.4.13.u16 (+63 more) | 7.4.13.u38, 7.3.10.u11, 7.2.10.fp20 |
| CVE-2023-42496 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting | CRITICAL | 7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+132 more) | 7.3.10.u34, 2023.Q3.6 |
| CVE-2024-25145 Liferay Portal stored cross-site scripting (XSS) vulnerability | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+108 more) | 7.4.3.13u8, 7.3.10.u4, 7.2.10.fp17 |
| CVE-2024-38002 Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions | CRITICAL | 2023.q4.0, 2023.q4.1, 2023.q4.2, 2023.q4.3 (+143 more) | 2023.Q4.6, 2023.Q3.9, 7.3.10.u36 (+1 more) |
| CVE-2023-42498 Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting | CRITICAL | 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4 (+85 more) | 2023.Q3.5 |
| CVE-2024-25147 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+19 more) | 7.3.10.u4, 7.2.10.fp15 |
| CVE-2023-42627 Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+128 more) | No fix available |
| CVE-2023-42628 Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget | CRITICAL | 7.0.10.fp100, 7.0.10.fp101, 7.0.10.fp102, 7.0.10.fp83 (+196 more) | 7.3.10.u34, 7.4.13.u88 |
| CVE-2024-25610 Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) | CRITICAL | 7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+122 more) | 7.4.13.u9, 7.3.10.u4, 7.2.10.fp19 |
| CVE-2022-42122 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module | CRITICAL | 7.3.10.fp2 | 7.3.10.u4 |
| CVE-2022-42120 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+18 more) | 7.3.10.u4, 7.4.13.u17 |
| CVE-2023-44311 Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class | CRITICAL | 7.4.13.u41, 7.4.13.u42, 7.4.13.u43, 7.4.13.u44 (+45 more) | 7.4.13.u90 |
| CVE-2023-42497 Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page | CRITICAL | 7.4.10.ep1, 7.4.11, 7.4.12, 7.4.13 (+81 more) | 7.4.13.u86 |
| CVE-2024-25603 Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting | CRITICAL | 7.4.13.u1, 7.4.13.u10, 7.4.13.u100, 7.4.13.u101 (+118 more) | 7.3.10.u4, 7.2.10.fp17 |
| CVE-2024-26266 Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting | CRITICAL | 7.4.13.u1, 7.4.13.u2, 7.4.13.u3, 7.4.13.u4 (+29 more) | 7.4.13.u10, 7.3.10.u4, 7.2.10.fp17 |
| CVE-2023-47795 Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting | CRITICAL | 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4 (+76 more) | 2023.Q3.6 |
| CVE-2023-40191 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting | CRITICAL | 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4 (+50 more) | 2023.Q3.6 |
| CVE-2024-25601 Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+21 more) | 7.3.10.u4, 7.2.10.fp17 |
| CVE-2024-25152 Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+21 more) | 7.3.10.u4, 7.2.10.fp17 |
| CVE-2024-25602 Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting | CRITICAL | 7.3.10, 7.3.10.ep3, 7.3.10.ep4, 7.3.10.ep5 (+21 more) | 7.3.10.u4, 7.2.10.fp17 |
| CVE-2024-26271 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget | HIGH | 2023.q4.0, 2023.q4.1, 2023.q4.2, 2023.q3.1 (+4 more) | 2023.Q4.3, 2023.Q3.6, 7.3u37 (+1 more) |
| CVE-2024-26273 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor | HIGH | 2023.q4.0, 2023.q4.1, 2023.q4.2, 2023.q3.1 (+4 more) | 2023.Q4.3, 2023.Q3.6, 7.4u93 (+1 more) |
| CVE-2024-26272 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor | HIGH | 2023.q4.0, 2023.q4.1, 2023.q4.2, 2023.q3.1 (+4 more) | 2023.Q4.3, 2023.Q3.6, 7.3u36 (+1 more) |
About This Data
Vulnerability data for com.liferay.portal:release.dxp.bom is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Maven (Java) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of com.liferay.portal:release.dxp.bom.