IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-19 14:15

MODIFIED

2025-08-20 14:40

EPSS (Prob. Exploit)

0.28%

Top 80.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-01

> DESCRIPTION

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-7mxq-h2r7-h449 MODERATE

Liferay Portal Email Modification Vulnerability via Calendar Portlet

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.calendar.service

< 6.0.83

Fixed in: 6.0.83

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-7mxq-h2r7-h449

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/08/2025 14:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui