Riskcovery

CVE-2024-25145

State
Published
Severity
9.6 Critical
Published
Feb 7, 2024
Updated
Aug 22, 2024
Reserved
Feb 6, 2024

Read the record on cve.org

Description

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Scores

CVSSScoreVectorSource
3.19.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HLiferay

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
PortalLiferay
  • 7.2.0 through 7.4.3.11Affected
DXPLiferay
  • 7.4.13 through 7.4.13.u7Affected
  • 7.3.10 through 7.3.10-dxp-3Affected
  • 7.2.10 through 7.2.10-dxp-16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.