CVE-2024-25152: XSS
First published: Wed Feb 21 2024(Updated: )
Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.
Credit: security@liferay.com security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.liferay.portal:release.dxp.bom | >=7.2.0<7.2.10.fp17 | 7.2.10.fp17 |
| maven/com.liferay.portal:release.dxp.bom | >=7.3.0<7.3.10.u4 | 7.3.10.u4 |
| maven/com.liferay.portal:release.portal.bom | <=7.4.2 | |
| Liferay 7.4 GA | <7.4.3.4 | |
| Liferay DXP | <7.2 | |
| Liferay DXP | =7.2 | |
| Liferay DXP | =7.2-fix_pack_1 | |
| Liferay DXP | =7.2-fix_pack_10 | |
| Liferay DXP | =7.2-fix_pack_11 | |
| Liferay DXP | =7.2-fix_pack_12 | |
| Liferay DXP | =7.2-fix_pack_13 | |
| Liferay DXP | =7.2-fix_pack_14 | |
| Liferay DXP | =7.2-fix_pack_15 | |
| Liferay DXP | =7.2-fix_pack_16 | |
| Liferay DXP | =7.2-fix_pack_2 | |
| Liferay DXP | =7.2-fix_pack_3 | |
| Liferay DXP | =7.2-fix_pack_4 | |
| Liferay DXP | =7.2-fix_pack_5 | |
| Liferay DXP | =7.2-fix_pack_6 | |
| Liferay DXP | =7.2-fix_pack_7 | |
| Liferay DXP | =7.2-fix_pack_8 | |
| Liferay DXP | =7.2-fix_pack_9 | |
| Liferay DXP | =7.2-service_pack_1 | |
| Liferay DXP | =7.2-service_pack_2 | |
| Liferay DXP | =7.2-service_pack_3 | |
| Liferay DXP | =7.2-service_pack_4 | |
| Liferay DXP | =7.2-service_pack_5 | |
| Liferay DXP | =7.3 | |
| Liferay DXP | =7.3-fix_pack_1 | |
| Liferay DXP | =7.3-fix_pack_2 | |
| Liferay DXP | =7.3-service_pack_1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-25152?
CVE-2024-25152 has been classified as a stored cross-site scripting (XSS) vulnerability, which can lead to potential data theft or session hijacking.
How do I fix CVE-2024-25152?
To mitigate CVE-2024-25152, upgrade to Liferay Portal versions 7.2.10.fp17, 7.3.10.u4, or higher.
Which versions of Liferay are affected by CVE-2024-25152?
CVE-2024-25152 affects Liferay Portal versions 7.2.0 through 7.4.2, as well as Liferay DXP 7.3 prior to service pack 3.
Who can exploit CVE-2024-25152?
Remote authenticated users can exploit CVE-2024-25152 to inject arbitrary web scripts in affected Liferay installations.
Is CVE-2024-25152 present in unsupported Liferay versions?
Yes, CVE-2024-25152 also impacts older unsupported versions of Liferay Portal and Liferay DXP.
- agent/description
- agent/first-publish-date
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-p28x-4r5h-ph6j
- alias/CVE-2024-25152
- agent/software-canonical-lookup
- agent/references
- agent/event
- agent/author
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/liferay
- canonical/liferay 7.4 ga
- canonical/liferay dxp
- version/liferay dxp/7.2
- version/liferay dxp/7.2-fix_pack_1
- version/liferay dxp/7.2-fix_pack_10
- version/liferay dxp/7.2-fix_pack_11
- version/liferay dxp/7.2-fix_pack_12
- version/liferay dxp/7.2-fix_pack_13
- version/liferay dxp/7.2-fix_pack_14
- version/liferay dxp/7.2-fix_pack_15
- version/liferay dxp/7.2-fix_pack_16
- version/liferay dxp/7.2-fix_pack_2
- version/liferay dxp/7.2-fix_pack_3
- version/liferay dxp/7.2-fix_pack_4
- version/liferay dxp/7.2-fix_pack_5
- version/liferay dxp/7.2-fix_pack_6
- version/liferay dxp/7.2-fix_pack_7
- version/liferay dxp/7.2-fix_pack_8
- version/liferay dxp/7.2-fix_pack_9
- version/liferay dxp/7.2-service_pack_1
- version/liferay dxp/7.2-service_pack_2
- version/liferay dxp/7.2-service_pack_3
- version/liferay dxp/7.2-service_pack_4
- version/liferay dxp/7.2-service_pack_5
- version/liferay dxp/7.3
- version/liferay dxp/7.3-fix_pack_1
- version/liferay dxp/7.3-fix_pack_2
- version/liferay dxp/7.3-service_pack_1