Lucene search

[email protected]CVE-2024-25144

HistoryFeb 08, 2024 - 4:15 a.m.

CVE-2024-25144

2024-02-0804:15:07

CWE-834

[email protected]

web.nvd.nist.gov

cve

iframe

liferay portal

dxp

security

dos

nvd

vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.3%

JSON

The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

Affected configurations

NVD

Node

liferaydxpMatch7.2-

liferaydxpMatch7.2fix_pack_1

liferaydxpMatch7.2fix_pack_10

liferaydxpMatch7.2fix_pack_11

liferaydxpMatch7.2fix_pack_12

liferaydxpMatch7.2fix_pack_13

liferaydxpMatch7.2fix_pack_14

liferaydxpMatch7.2fix_pack_15

liferaydxpMatch7.2fix_pack_16

liferaydxpMatch7.2fix_pack_17

liferaydxpMatch7.2fix_pack_18

liferaydxpMatch7.2fix_pack_2

liferaydxpMatch7.2fix_pack_3

liferaydxpMatch7.2fix_pack_4

liferaydxpMatch7.2fix_pack_5

liferaydxpMatch7.2fix_pack_6

liferaydxpMatch7.2fix_pack_7

liferaydxpMatch7.2fix_pack_8

liferaydxpMatch7.2fix_pack_9

liferaydxpMatch7.3-

liferaydxpMatch7.3sp1

liferaydxpMatch7.3sp2

liferaydxpMatch7.3sp3

liferaydxpMatch7.3update_1

liferaydxpMatch7.3update_2

liferaydxpMatch7.3update_3

liferaydxpMatch7.3update_4

liferaydxpMatch7.3update_5

liferaydxpMatch7.4-

liferaydxpMatch7.4update_1

liferaydxpMatch7.4update_10

liferaydxpMatch7.4update_11

liferaydxpMatch7.4update_12

liferaydxpMatch7.4update_13

liferaydxpMatch7.4update_14

liferaydxpMatch7.4update_15

liferaydxpMatch7.4update_16

liferaydxpMatch7.4update_17

liferaydxpMatch7.4update_18

liferaydxpMatch7.4update_19

liferaydxpMatch7.4update_2

liferaydxpMatch7.4update_20

liferaydxpMatch7.4update_21

liferaydxpMatch7.4update_22

liferaydxpMatch7.4update_23

liferaydxpMatch7.4update_24

liferaydxpMatch7.4update_25

liferaydxpMatch7.4update_26

liferaydxpMatch7.4update_3

liferaydxpMatch7.4update_4

liferaydxpMatch7.4update_5

liferaydxpMatch7.4update_6

liferaydxpMatch7.4update_7

liferaydxpMatch7.4update_8

liferaydxpMatch7.4update_9

liferayliferay_portalRange7.2.0–7.4.3.26

CPENameOperatorVersion
liferay:dxpliferay dxpeq7.2
liferay:dxpliferay dxpeq7.3
liferay:dxpliferay dxpeq7.4
liferay:liferay_portalliferay liferay portallt7.4.3.26

CPE	Name	Operator	Version
liferay:dxp	liferay dxp	eq	7.2
liferay:dxp	liferay dxp	eq	7.3
liferay:dxp	liferay dxp	eq	7.4
liferay:liferay_portal	liferay liferay portal	lt	7.4.3.26

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.26",
        "status": "affected",
        "version": "7.2.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u26",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.3.10.u5",
        "status": "affected",
        "version": "7.3.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.2.10-dxp-18",
        "status": "affected",
        "version": "7.2.10",
        "versionType": "maven"
      }
    ]
  }
]