Paper/Archive/CVE-2024-25610

CVE-2024-25610

Liferay Portal — In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 b…

EPSS 0.5%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 44.0.440 × 208.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.

Affected

ProductAffectedFixed inSource

Portal7.2.0 – 7.4.3.12–CNA

DXP7.4.13 – 7.4.13.u8–CNA

DXP7.3.10 – 7.3.10-dxp-3–CNA

DXP7.2.10 – 7.2.10-dxp-18–CNA

portal7.2.0 – 7.4.3.12–CISA-ADP

digital_experience_platform7.2.10 – 7.2.10-dxp-18–CISA-ADP

digital_experience_platform7.3.10 – 7.3.10-dxp-3–CISA-ADP

digital_experience_platform7.4.13 – 7.4.13.u8–CISA-ADP

Scores by source

Liferay (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610