GCVE - cpe:2.3:a:liferay:liferay_enterprise_portal:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:liferay:liferay_enterprise_portal:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Liferay (`5231553d-d54f-5cd9-bf56-0bf2ac7f0033`)
Product	Liferay Enterprise Portal (`62ff701a-44c0-5951-805f-72c8e572b10f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/km-works/liferay-portal-rpc`	purl2cpe	2026-06-01 10:15:56.436664
`pkg:github/liferay/liferay-portal`	purl2cpe	2026-06-01 10:15:56.436666
`pkg:maven/com.liferay/liferay-portal-src`	purl2cpe	2026-06-01 10:15:56.436667

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-26268`	vulnerable	2026-06-08 06:31:26.033238	Details available MEDIUM (5.3) User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time. Published: 2024-02-20T13:17:28.137Z Updated: 2024-08-15T17:50:15.783Z Open on db.gcve.eu Reference links https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0182`	vulnerable	2026-06-08 04:50:10.446762	Details available Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message. Published: 2008-02-04T23:00:00.000Z Updated: 2024-09-17T02:27:19.192Z Open on db.gcve.eu Reference links http://www.kb.cert.org/vuls/id/767825 http://secunia.com/advisories/28742 http://support.liferay.com/browse/LEP-4739	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-0180`	vulnerable	2026-06-08 04:50:10.440246	Details available Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile. Published: 2008-02-04T23:00:00.000Z Updated: 2024-09-16T23:41:28.866Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/27546 http://secunia.com/advisories/28742 http://www.kb.cert.org/vuls/id/732449 http://support.liferay.com/browse/LEP-4738	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2004-2030`	vulnerable	2026-06-08 04:48:08.354194	Details available Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the message subject. Published: 2005-05-10T04:00:00.000Z Updated: 2024-08-08T01:15:01.197Z Open on db.gcve.eu Reference links http://marc.info/?l=bugtraq&m=110141194202856&w=2 http://securitytracker.com/id?1010259 http://secunia.com/advisories/11692 http://www.osvdb.org/6346 http://sourceforge.net/project/shownotes.php?release_id=252060	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.