Lucene search

K
cve[email protected]CVE-2024-25145
HistoryFeb 07, 2024 - 3:15 p.m.

CVE-2024-25145

2024-02-0715:15:09
CWE-79
web.nvd.nist.gov
14
cve-2024-25145
stored xss
liferay portal
nvd
security vulnerability
cross-site scripting
search result
portal search module

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.0%

Stored cross-site scripting (XSS) vulnerability in the Portal Search module’s Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app’s search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Affected configurations

NVD
Node
liferaydxpRange<7.2
OR
liferaydxpMatch7.2-
OR
liferaydxpMatch7.2fix_pack_1
OR
liferaydxpMatch7.2fix_pack_10
OR
liferaydxpMatch7.2fix_pack_11
OR
liferaydxpMatch7.2fix_pack_12
OR
liferaydxpMatch7.2fix_pack_13
OR
liferaydxpMatch7.2fix_pack_14
OR
liferaydxpMatch7.2fix_pack_15
OR
liferaydxpMatch7.2fix_pack_2
OR
liferaydxpMatch7.2fix_pack_3
OR
liferaydxpMatch7.2fix_pack_4
OR
liferaydxpMatch7.2fix_pack_5
OR
liferaydxpMatch7.2fix_pack_6
OR
liferaydxpMatch7.2fix_pack_7
OR
liferaydxpMatch7.2fix_pack_8
OR
liferaydxpMatch7.2fix_pack_9
OR
liferaydxpMatch7.3-
OR
liferaydxpMatch7.3fix_pack_2
OR
liferaydxpMatch7.3sp1
OR
liferaydxpMatch7.3sp2
OR
liferaydxpMatch7.3sp3
OR
liferaydxpMatch7.3update_1
OR
liferaydxpMatch7.3update_2
OR
liferaydxpMatch7.3update_3
OR
liferaydxpMatch7.4-
OR
liferaydxpMatch7.4update_1
OR
liferaydxpMatch7.4update_2
OR
liferaydxpMatch7.4update_3
OR
liferaydxpMatch7.4update_4
OR
liferaydxpMatch7.4update_5
OR
liferaydxpMatch7.4update_6
OR
liferaydxpMatch7.4update_7
OR
liferayliferay_portalRange7.2.1
OR
liferayliferay_portalRange7.3.07.3.7
OR
liferayliferay_portalRange7.4.07.4.3.12

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.11",
        "status": "affected",
        "version": "7.2.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u7",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.3.10-dxp-3",
        "status": "affected",
        "version": "7.3.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.2.10-dxp-16",
        "status": "affected",
        "version": "7.2.10",
        "versionType": "maven"
      }
    ]
  }
]

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.0%

Related for CVE-2024-25145