CVE-2024-11993

Published: Dec 17, 2024Modified: Mar 28, 2025

4.6

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@liferay.com (Secondary)

Description

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Affected (41)

Products: Liferay: Liferay Portal, Digital Experience Platform

Liferay

2 products

Liferay Portal

Digital Experience Platform

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Liferay Liferay Portal	From 7.1.0 to 7.4.3.39

Configuration B

40 vulnerable

Vulnerable Software	Affected Versions
Liferay Digital Experience Platform	From 7.1 to 7.4
Liferay Digital Experience Platform	Version 7.4
Liferay Digital Experience Platform	Version 7.4 update10
Liferay Digital Experience Platform	Version 7.4 update11
Liferay Digital Experience Platform	Version 7.4 update12
Liferay Digital Experience Platform	Version 7.4 update13
Liferay Digital Experience Platform	Version 7.4 update14
Liferay Digital Experience Platform	Version 7.4 update15
Liferay Digital Experience Platform	Version 7.4 update16
Liferay Digital Experience Platform	Version 7.4 update17
Liferay Digital Experience Platform	Version 7.4 update18
Liferay Digital Experience Platform	Version 7.4 update19
Liferay Digital Experience Platform	Version 7.4 update1
Liferay Digital Experience Platform	Version 7.4 update20
Liferay Digital Experience Platform	Version 7.4 update21
Liferay Digital Experience Platform	Version 7.4 update22
Liferay Digital Experience Platform	Version 7.4 update23
Liferay Digital Experience Platform	Version 7.4 update24
Liferay Digital Experience Platform	Version 7.4 update25
Liferay Digital Experience Platform	Version 7.4 update26
Liferay Digital Experience Platform	Version 7.4 update27
Liferay Digital Experience Platform	Version 7.4 update28
Liferay Digital Experience Platform	Version 7.4 update29
Liferay Digital Experience Platform	Version 7.4 update2
Liferay Digital Experience Platform	Version 7.4 update30
Liferay Digital Experience Platform	Version 7.4 update31
Liferay Digital Experience Platform	Version 7.4 update32
Liferay Digital Experience Platform	Version 7.4 update33
Liferay Digital Experience Platform	Version 7.4 update34
Liferay Digital Experience Platform	Version 7.4 update35
Liferay Digital Experience Platform	Version 7.4 update36
Liferay Digital Experience Platform	Version 7.4 update37
Liferay Digital Experience Platform	Version 7.4 update38
Liferay Digital Experience Platform	Version 7.4 update3
Liferay Digital Experience Platform	Version 7.4 update4
Liferay Digital Experience Platform	Version 7.4 update5
Liferay Digital Experience Platform	Version 7.4 update6
Liferay Digital Experience Platform	Version 7.4 update7
Liferay Digital Experience Platform	Version 7.4 update8
Liferay Digital Experience Platform	Version 7.4 update9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993

Source: security@liferay.com

Vendor Advisory

Timeline

No history available yet.