Liferay Portal 7.4.0
Approved changes feed: RSS · Atom
cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*
part: a version: 7.4.0 update: *
| Vendor | Liferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033) |
|---|---|
| Product | Liferay Portal (e3d198b8-0678-58dd-bf73-106b66a02cfe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/liferay/portal |
purl2cpe | 2026-06-01 10:15:56.373440 |
pkg:github/liferay/liferay-portal |
purl2cpe | 2026-06-01 10:15:56.373441 |
pkg:liferay/liferay-portal |
purl2cpe | 2026-06-01 10:15:56.373443 |
pkg:sourceforge/lportal |
purl2cpe | 2026-06-01 10:15:56.373444 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-25607 |
vulnerable | 2026-06-08 06:31:23.454127 |
Details available
HIGH (8.1)
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.
Published: 2024-02-20T09:17:04.894Z
Updated: 2024-08-01T23:44:09.762Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33938 |
vulnerable | 2026-06-08 06:06:23.940486 |
Details available
MEDIUM (4.8)
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Published: 2023-05-24T13:20:19.626Z
Updated: 2024-10-22T15:52:48.350Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-26595 |
vulnerable | 2026-06-08 05:41:52.530159 |
Details available
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Published: 2022-04-19T12:52:20.000Z
Updated: 2026-07-09T00:18:01.366Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-26594 |
vulnerable | 2026-06-08 05:41:52.527217 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
Published: 2022-04-15T15:50:26.000Z
Updated: 2026-07-09T00:18:00.115Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-26593 |
vulnerable | 2026-06-08 05:41:52.526674 |
Details available
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.
Published: 2022-04-19T12:46:15.000Z
Updated: 2026-07-09T00:17:58.874Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38269 |
vulnerable | 2026-06-08 05:32:55.816469 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38264 |
vulnerable | 2026-06-08 05:32:55.791927 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-35463 |
vulnerable | 2026-06-08 05:32:48.726010 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.