Liferay DXP 7.2 Fix Pack 16

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:dxp:7.2:fix_pack_16:*:*:*:*:*:*

part: a version: 7.2 update: fix_pack_16

VendorLiferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033)
ProductDxp (3a78ccbe-3312-579d-a5a1-5eda84a793d3)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-25146 vulnerable 2026-06-08 06:31:22.411834 Details available
MEDIUM (5.3)
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.
Published: 2024-02-08T03:36:07.512Z
Updated: 2025-05-15T19:40:55.792Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-25144 vulnerable 2026-06-08 06:31:22.318545 Details available
MEDIUM (4.1)
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
Published: 2024-02-08T03:25:31.037Z
Updated: 2024-10-02T15:31:02.494Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.