The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix…
Priority LOW 26CWE-209Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-209.
Summary
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.
Why it matters now
EPSS 0.01081 65th percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.3.5com.liferay.portal:release.dxp.bom (Maven): 7.0.10.fp97, 7.1.10.fp20, 7.2.10.fp10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.liferay.portal:release.portal.bom (Maven) | before 7.3.5 | 7.3.5 | Patch available | GHSA-87x7-pwrx-jch7 |
| — | com.liferay.portal:release.dxp.bom (Maven) | before 7.0.10.fp97 | 7.0.10.fp97 | Patch available | GHSA-87x7-pwrx-jch7 |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.1.0 to before 7.1.10.fp20 | 7.1.10.fp20 | Patch available | GHSA-87x7-pwrx-jch7 |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.2.0 to before 7.2.10.fp10 | 7.2.10.fp10 | Patch available | GHSA-87x7-pwrx-jch7 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.liferay.portal:release.portal.bom (Maven) Vendor— Affected before 7.3.5 Fixed in 7.3.5 Patch available GHSA-87x7-pwrx-jch7
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected before 7.0.10.fp97 Fixed in 7.0.10.fp97 Patch available GHSA-87x7-pwrx-jch7
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.0 to before 7.1.10.fp20 Fixed in 7.1.10.fp20 Patch available GHSA-87x7-pwrx-jch7
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp10 Fixed in 7.2.10.fp10 Patch available GHSA-87x7-pwrx-jch7
CPE configurations NVD · 98
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | before 7.0 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* | 7.0 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* | 7.0 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* | 7.0 fix_pack_24 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* | 7.0 fix_pack_25 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* | 7.0 fix_pack_26 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* | 7.0 fix_pack_27 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* | 7.0 fix_pack_28 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* | 7.0 fix_pack_3 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* Versions before 7.0 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* Versions 7.0 fix_pack_3 Vulnerable ·Liferay
Show 88 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* | 7.0 fix_pack_30 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* | 7.0 fix_pack_33 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* | 7.0 fix_pack_35 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* | 7.0 fix_pack_36 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* | 7.0 fix_pack_39 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* | 7.0 fix_pack_40 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* | 7.0 fix_pack_41 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* | 7.0 fix_pack_42 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* | 7.0 fix_pack_43 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* | 7.0 fix_pack_44 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* | 7.0 fix_pack_45 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* | 7.0 fix_pack_46 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* | 7.0 fix_pack_47 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* | 7.0 fix_pack_48 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* | 7.0 fix_pack_49 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* | 7.0 fix_pack_50 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* | 7.0 fix_pack_51 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* | 7.0 fix_pack_52 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* | 7.0 fix_pack_53 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* | 7.0 fix_pack_54 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* | 7.0 fix_pack_56 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* | 7.0 fix_pack_57 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* | 7.0 fix_pack_58 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* | 7.0 fix_pack_59 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* | 7.0 fix_pack_60 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* | 7.0 fix_pack_61 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* | 7.0 fix_pack_64 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* | 7.0 fix_pack_65 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* | 7.0 fix_pack_66 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* | 7.0 fix_pack_67 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* | 7.0 fix_pack_68 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* | 7.0 fix_pack_69 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* | 7.0 fix_pack_70 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* | 7.0 fix_pack_71 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* | 7.0 fix_pack_72 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* | 7.0 fix_pack_73 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* | 7.0 fix_pack_75 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* | 7.0 fix_pack_76 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* | 7.0 fix_pack_78 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* | 7.0 fix_pack_79 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* | 7.0 fix_pack_80 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* | 7.0 fix_pack_81 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* | 7.0 fix_pack_82 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* | 7.0 fix_pack_83 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* | 7.0 fix_pack_84 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* | 7.0 fix_pack_85 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* | 7.0 fix_pack_86 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* | 7.0 fix_pack_87 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* | 7.0 fix_pack_88 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* | 7.0 fix_pack_89 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* | 7.0 fix_pack_90 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* | 7.0 fix_pack_91 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* | 7.0 fix_pack_92 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* | 7.0 fix_pack_93 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* | 7.0 fix_pack_94 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* | 7.0 fix_pack_95 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:* | 7.0 fix_pack_96 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* | 7.1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* | 7.1 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* | 7.1 fix_pack_10 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* | 7.1 fix_pack_11 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* | 7.1 fix_pack_12 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* | 7.1 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* | 7.1 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* | 7.1 fix_pack_15 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* | 7.1 fix_pack_16 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* | 7.1 fix_pack_17 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* | 7.1 fix_pack_18 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* | 7.1 fix_pack_19 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* | 7.1 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* | 7.1 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* | 7.1 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* | 7.1 fix_pack_5 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* | 7.1 fix_pack_6 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* | 7.1 fix_pack_7 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* | 7.1 fix_pack_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* | 7.1 fix_pack_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* | 7.2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* | 7.2 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* | 7.2 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* | 7.2 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* | 7.2 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* | 7.2 fix_pack_5 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* | 7.2 fix_pack_6 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* | 7.2 fix_pack_7 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* | 7.2 fix_pack_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* | 7.2 fix_pack_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* | up to 7.3.4 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* Versions 7.0 fix_pack_83 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* Versions 7.0 fix_pack_84 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* Versions 7.0 fix_pack_85 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* Versions 7.0 fix_pack_86 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* Versions 7.0 fix_pack_87 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* Versions 7.0 fix_pack_88 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* Versions 7.0 fix_pack_89 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* Versions 7.0 fix_pack_90 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* Versions 7.0 fix_pack_91 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* Versions 7.0 fix_pack_92 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* Versions 7.0 fix_pack_93 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* Versions 7.0 fix_pack_94 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* Versions 7.0 fix_pack_95 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_96:*:*:*:*:*:* Versions 7.0 fix_pack_96 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* Versions 7.1 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* Versions 7.1 fix_pack_10 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* Versions 7.1 fix_pack_11 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* Versions 7.1 fix_pack_12 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* Versions 7.1 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* Versions 7.1 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* Versions 7.1 fix_pack_15 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* Versions 7.1 fix_pack_16 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* Versions 7.1 fix_pack_17 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* Versions 7.1 fix_pack_18 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:* Versions 7.1 fix_pack_19 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* Versions 7.1 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* Versions 7.1 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* Versions 7.1 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* Versions 7.1 fix_pack_5 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* Versions 7.1 fix_pack_6 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* Versions 7.1 fix_pack_7 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* Versions 7.1 fix_pack_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* Versions 7.1 fix_pack_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* Versions 7.2 fix_pack_5 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* Versions 7.2 fix_pack_6 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* Versions 7.2 fix_pack_7 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* Versions 7.2 fix_pack_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* Versions 7.2 fix_pack_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions up to 7.3.4 Vulnerable ·Liferay
Remediation
- Fix · GHSA-87x7-pwrx-jch7 com.liferay.portal:release.portal.bom (Maven) Fixed in 7.3.5 Advisory →
- Fix · GHSA-87x7-pwrx-jch7 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.0.10.fp97 Advisory →
- Fix · GHSA-87x7-pwrx-jch7 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.1.10.fp20 Advisory →
- Fix · GHSA-87x7-pwrx-jch7 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29040
- 2026-10-03 Alias added: GHSA-87x7-pwrx-jch7
References
Advisory 2
More Liferay Digital Experience Platform vulnerabilities
- TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
- TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
- TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
- TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
Sources
- CVE-2021-29040 · CVE Program
- CVE-2021-29040 · NVD
- FIRST EPSS
- GHSA-87x7-pwrx-jch7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences