Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-25145

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Published

2024-02-07T15:15:09.097

Last Modified

2025-05-13T18:17:51.450

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.6 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-79
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application liferay digital_experience_platform < 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay digital_experience_platform 7.2 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.3 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay dxp 7.4 Yes
Application liferay liferay_portal ≤ 7.2.1 Yes
Application liferay liferay_portal ≤ 7.3.7 Yes
Application liferay liferay_portal < 7.4.3.12 Yes
References