Lucene search

[email protected]CVE-2024-25145

HistoryFeb 07, 2024 - 3:15 p.m.

CVE-2024-25145

2024-02-0715:15:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-25145

stored xss

liferay portal

nvd

security vulnerability

cross-site scripting

search result

portal search module

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.1%

JSON

Stored cross-site scripting (XSS) vulnerability in the Portal Search module’s Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app’s search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Affected configurations

NVD

Node

liferaydxpRange<7.2

liferaydxpMatch7.2-

liferaydxpMatch7.2fix_pack_1

liferaydxpMatch7.2fix_pack_10

liferaydxpMatch7.2fix_pack_11

liferaydxpMatch7.2fix_pack_12

liferaydxpMatch7.2fix_pack_13

liferaydxpMatch7.2fix_pack_14

liferaydxpMatch7.2fix_pack_15

liferaydxpMatch7.2fix_pack_2

liferaydxpMatch7.2fix_pack_3

liferaydxpMatch7.2fix_pack_4

liferaydxpMatch7.2fix_pack_5

liferaydxpMatch7.2fix_pack_6

liferaydxpMatch7.2fix_pack_7

liferaydxpMatch7.2fix_pack_8

liferaydxpMatch7.2fix_pack_9

liferaydxpMatch7.3-

liferaydxpMatch7.3fix_pack_2

liferaydxpMatch7.3sp1

liferaydxpMatch7.3sp2

liferaydxpMatch7.3sp3

liferaydxpMatch7.3update_1

liferaydxpMatch7.3update_2

liferaydxpMatch7.3update_3

liferaydxpMatch7.4-

liferaydxpMatch7.4update_1

liferaydxpMatch7.4update_2

liferaydxpMatch7.4update_3

liferaydxpMatch7.4update_4

liferaydxpMatch7.4update_5

liferaydxpMatch7.4update_6

liferaydxpMatch7.4update_7

liferayliferay_portalRange≤7.2.1

liferayliferay_portalRange7.3.0–7.3.7

liferayliferay_portalRange7.4.0–7.4.3.12

CPENameOperatorVersion
liferay:dxpliferay dxplt7.2
liferay:dxpliferay dxpeq7.3
liferay:dxpliferay dxpeq7.4
liferay:liferay_portalliferay liferay portalle7.2.1
liferay:liferay_portalliferay liferay portalle7.3.7
liferay:liferay_portalliferay liferay portallt7.4.3.12

CPE	Name	Operator	Version
liferay:dxp	liferay dxp	lt	7.2
liferay:dxp	liferay dxp	eq	7.3
liferay:dxp	liferay dxp	eq	7.4
liferay:liferay_portal	liferay liferay portal	le	7.2.1
liferay:liferay_portal	liferay liferay portal	le	7.3.7
liferay:liferay_portal	liferay liferay portal	lt	7.4.3.12

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.11",
        "status": "affected",
        "version": "7.2.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u7",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.3.10-dxp-3",
        "status": "affected",
        "version": "7.3.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.2.10-dxp-16",
        "status": "affected",
        "version": "7.2.10",
        "versionType": "maven"
      }
    ]
  }
]