CVE-2024-26269

CRITICAL

Liferay Portal 7.2.0-7.4.3.37 and DXP < 7.4 Update 38 - Cross-Site Scripting via URL Anchor

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

References (1)

Core 1

Scores

CVSS v3 9.6
EPSS 0.0019
EPSS Percentile 40.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (5)
com.liferay.portal/release.dxp.bom 7.4.13.u1 - 7.4.13.u38Maven
com.liferay.portal/release.portal.bom 7.2.0 - 7.4.3.38Maven
liferay/digital_experience_platform 7.2 (27 CPE variants)
liferay/digital_experience_platform 7.3 (12 CPE variants)
liferay/digital_experience_platform 7.4 (9 CPE variants)
Published Feb 21, 2024
Tracked Since Feb 18, 2026