Lucene search

GoogleOSV:GHSA-W275-M8CR-HF2V

HistoryFeb 08, 2024 - 6:30 a.m.

Liferay Portal denial-of-service vulnerability

2024-02-0806:30:23

Google

osv.dev

liferay portal

iframe widget

denial-of-service

vulnerability

remote authenticated users

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.4%

JSON

The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

CPENameOperatorVersion
com.liferay.portal:release.dxp.bomeq7.3.10.ep3
com.liferay.portal:release.portal.bomeq7.4.3.21
com.liferay.portal:release.dxp.bomeq7.2.10.fp17
com.liferay.portal:release.portal.bomeq7.4.3.26
com.liferay.portal:release.dxp.bomeq7.3.10.fp1
com.liferay.portal:release.portal.bomeq7.4.3.5
com.liferay.portal:release.portal.bomeq7.2.1-1
com.liferay.portal:release.portal.bomeq7.4.2
com.liferay.portal:release.portal.bomeq7.4.3.25
com.liferay.portal:release.portal.bomeq7.4.3.17

Name	Operator	Version
com.liferay.portal:release.dxp.bom	eq	7.3.10.ep3
com.liferay.portal:release.portal.bom	eq	7.4.3.21
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp17
com.liferay.portal:release.portal.bom	eq	7.4.3.26
com.liferay.portal:release.dxp.bom	eq	7.3.10.fp1
com.liferay.portal:release.portal.bom	eq	7.4.3.5
com.liferay.portal:release.portal.bom	eq	7.2.1-1
com.liferay.portal:release.portal.bom	eq	7.4.2
com.liferay.portal:release.portal.bom	eq	7.4.3.25
com.liferay.portal:release.portal.bom	eq	7.4.3.17

Rows per page:

1-10 of 1001

References

github.com/liferay/liferay-portal

liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144

nvd.nist.gov/vuln/detail/CVE-2024-25144

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.4%

JSON

Related for OSV:GHSA-W275-M8CR-HF2V