CVE-2024-25151: XSS

Q: What is the severity of CVE-2024-25151?

CVE-2024-25151 is considered a critical vulnerability due to inadequate data escaping in notification email templates that can lead to remote code execution.

Q: How do I fix CVE-2024-25151?

To fix CVE-2024-25151, upgrade to Liferay Portal 7.2.10.fp15, 7.3.10.u4, or Liferay DXP 7.4.3.4.

Q: Which Liferay versions are affected by CVE-2024-25151?

CVE-2024-25151 affects Liferay Portal versions 7.2.0 through 7.4.2 and Liferay DXP 7.3 prior to service pack 3.

Q: What kind of impact does CVE-2024-25151 have?

CVE-2024-25151 allows attackers to exploit vulnerabilities in notification emails, potentially leading to unauthorized access or data manipulation.

Q: Is there a workaround for CVE-2024-25151 if I cannot upgrade?

There are no recommended workarounds for CVE-2024-25151, upgrading is the best solution to mitigate the risks.

Published Feb 21, 2024

Updated

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.

Affected Software

30 affected componentsFixes available

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp15

7.2.10.fp15

maven/com.liferay.portal:release.dxp.bom>=7.3.0<7.3.10.u4

7.3.10.u4

maven/com.liferay.portal:release.portal.bom<=7.4.2

7.4.3.4

Liferay Liferay Portal>=7.2.0<7.4.3.4

Liferay Digital Experience Platform<7.2

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Liferay Digital Experience Platform=7.2-service_pack_1

Liferay Digital Experience Platform=7.2-service_pack_2

Liferay Digital Experience Platform=7.2-service_pack_3

Liferay Digital Experience Platform=7.2-service_pack_4

Liferay Digital Experience Platform=7.2-service_pack_5

Liferay Digital Experience Platform=7.3

Liferay Digital Experience Platform=7.3-fix_pack_1

Liferay Digital Experience Platform=7.3-fix_pack_2

Liferay Digital Experience Platform=7.3-service_pack_1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.2.10.fp15
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.3.10.u4
Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.3.4
Upgrade
Upgrade Liferay Portal Calendar module to a version that resolves this vulnerability.
Fixed in 7.4.2
Upgrade
Upgrade Liferay DXP Calendar module to a version that resolves this vulnerability.
Fixed in 7.3 before service pack 3
Upgrade
Upgrade Liferay Portal to a version that resolves this vulnerability.
Patch 7.2 before fix pack 15

Event History

Feb 21, 2024

CVE Published

via MITRE·03:17 AM

Data Sourced

via MITRE·03:17 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·06:30 AM

Frequently Asked Questions

What is the severity of CVE-2024-25151?

CVE-2024-25151 is considered a critical vulnerability due to inadequate data escaping in notification email templates that can lead to remote code execution.

How do I fix CVE-2024-25151?