CVE-2024-25145: Liferay Portal stored cross-site scripting (XSS) vulnerability
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is…
Published Feb 7, 2024
Affected packages
com.liferay.portal:release.portal.bom
- Ecosystem
- Maven
- Affected
- < 7.4.3.12
- Fixed in
- 7.4.3.12
- Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.portal.bom
com.liferay.portal:release.dxp.bom
- Ecosystem
- Maven
- Affected
- >= 7.4.0, < 7.4.3.13u8
- Fixed in
- 7.4.3.13u8
- Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom
com.liferay.portal:release.dxp.bom
- Ecosystem
- Maven
- Affected
- >= 7.3.0, < 7.3.10.u4
- Fixed in
- 7.3.10.u4
- Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom
com.liferay.portal:release.dxp.bom
- Ecosystem
- Maven
- Affected
- < 7.2.10.fp17
- Fixed in
- 7.2.10.fp17
- Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Maven vulnerabilities
All Maven entriesCVE-2024-38002
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
critical9.0Oct 22, 2024CVE-2024-8980
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
critical9.6No fixOct 22, 2024CVE-2023-40191
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
critical9.0No fixFeb 21, 2024CVE-2023-42496
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
critical9.6No fixFeb 21, 2024CVE-2023-42498
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
critical9.6No fixFeb 21, 2024CVE-2023-47795
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
critical9.0No fixFeb 21, 2024