CVE-2024-25144
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
Affected (56)
Products: Liferay: Digital Experience Platform, Dxp, Liferay Portal
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 7.2 | |
| Version 7.3 | |
| From 7.2.0 to 7.4.3.26 |
Related CWEs
CWE-834
Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References (2)
Source: security@liferay.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.