CVE-2024-25603

EPSS 0.56%
Veröffentlicht 21.02.2024 03:15:09
Zuletzt bearbeitet 28.01.2025 02:39:55
Erkennungen
Login

Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 30 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Liferay Portal Version >= 7.2.0 < 7.4.3.5

Liferay ≫ Digital Experience Platform Version < 7.2

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_5

Liferay ≫ Digital Experience Platform Version 7.3 Update -

Liferay ≫ Digital Experience Platform Version 7.3 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.3 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.3 Update service_pack_1

Liferay ≫ Digital Experience Platform Version 7.3 Update service_pack_3

Liferay ≫ Digital Experience Platform Version 7.4 Update -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.56%	0.42

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
security@liferay.com	9	2.3	6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-25603

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-25603

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-25603

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2024-25603