CVE-2024-25603: XSS

Q: What is the severity of CVE-2024-25603?

CVE-2024-25603 has been classified as a stored cross-site scripting (XSS) vulnerability.

Q: How do I fix CVE-2024-25603?

To fix CVE-2024-25603, update Liferay Portal to versions 7.2.10.fp17, 7.3.10.u4, or 7.4.3.5 or later.

Q: What versions of Liferay Portal are affected by CVE-2024-25603?

CVE-2024-25603 affects Liferay Portal versions 7.2.0 through 7.4.3.4 and older unsupported versions.

Q: Can remote authenticated users exploit CVE-2024-25603?

Yes, CVE-2024-25603 can be exploited by remote authenticated users due to the stored XSS vulnerability.

Q: Why is it important to address CVE-2024-25603 quickly?

Addressing CVE-2024-25603 quickly is important to prevent potential exploitation leading to unauthorized access or data manipulation.

Published Feb 21, 2024

Updated

Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

Affected Software

34 affected componentsFixes available

maven/com.liferay.portal:release.portal.bom<=7.4.3.4

7.4.3.5

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp17

7.2.10.fp17

maven/com.liferay.portal:release.dxp.bom>=7.3.10.ep3<7.3.10.u4

7.3.10.u4

maven/com.liferay.portal:release.dxp.bom>=7.4.13.u1<=7.4.13.u102

Liferay Liferay Portal>=7.2.0<7.4.3.5

Liferay Digital Experience Platform<7.2

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_15

Liferay Digital Experience Platform=7.2-fix_pack_16

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Liferay Digital Experience Platform=7.2-service_pack_1

Liferay Digital Experience Platform=7.2-service_pack_2

Liferay Digital Experience Platform=7.2-service_pack_3

Liferay Digital Experience Platform=7.2-service_pack_4

Liferay Digital Experience Platform=7.2-service_pack_5

Liferay Digital Experience Platform=7.3

Liferay Digital Experience Platform=7.3-fix_pack_1

Liferay Digital Experience Platform=7.3-fix_pack_2

Liferay Digital Experience Platform=7.3-service_pack_1

Liferay Digital Experience Platform=7.3-service_pack_3

Liferay Digital Experience Platform=7.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.3.5
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.2.10.fp17
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.3.10.u4
Upgrade
Upgrade Liferay Portal Dynamic Data Mapping (DDM) - DDMForm (instanceId parameter) to a version that resolves this vulnerability.
Fixed in 7.4.13
Upgrade
Upgrade Liferay Portal Dynamic Data Mapping (DDM) - DDMForm (instanceId parameter) to a version that resolves this vulnerability.
Patch 7.3 before update 4
Upgrade
Upgrade Liferay Portal Dynamic Data Mapping (DDM) - DDMForm (instanceId parameter) to a version that resolves this vulnerability.
Patch 7.2 before fix pack 17

Event History

Feb 21, 2024

CVE Published

via MITRE·02:09 AM

Data Sourced

via MITRE·02:09 AM

DescriptionSeverityWeakness

Advisory Published

via GitHub·03:30 AM

Frequently Asked Questions

What is the severity of CVE-2024-25603?

CVE-2024-25603 has been classified as a stored cross-site scripting (XSS) vulnerability.

How do I fix CVE-2024-25603?