Cross-site Scripting (XSS)

🗓️ 22 Feb 2024 09:20:57Reported by Veracode Vulnerability DatabaseType

Liferay Portal XSS vulnerability in Announcement and Alerts widget

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-26266	21 Feb 202404:21	–	circl
CNNVD	Liferay Portal and Liferay DXP Security Vulnerabilities	21 Feb 202400:00	–	cnnvd
CVE	CVE-2024-26266	21 Feb 202402:32	–	cve
Cvelist	CVE-2024-26266	21 Feb 202402:32	–	cvelist
EUVD	EUVD-2024-0723	3 Oct 202520:07	–	euvd
Github Security Blog	Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting	21 Feb 202403:30	–	github
Tenable Nessus	Liferay Portal 7.4.x < 7.4.3.14 XSS	23 Feb 202400:00	–	nessus
NCSC	Vulnerabilities fixed in Liferay Portal and DXP	22 Feb 202400:00	–	ncsc
NVD	CVE-2024-26266	21 Feb 202403:15	–	nvd
OSV	CVE-2024-26266	21 Feb 202403:15	–	osv

Vulners

Node

liferay release.dxp.bomRange7.4.13.u1–7.4.13.u9java

liferay release.dxp.bomRange7.3.10.ep3–7.3.10.fp2java

liferay release.dxp.bomRange7.2.0–7.2.10.fp16java

liferay release.portal.bomRange7.4.0–7.4.3.13java

liferay release.dxp.apiRange7.3.10-ep3–7.3.10-ga1-2java

liferay release.dxp.apiRange7.2.10.fp1–7.2.10.fp16java

liferay release.dxp.apiRange7.4.13.u1–7.4.13.u9java

liferay release.portal.apiRange7.4.0-ga1–7.4.3.13-ga13java

liferay release.portal.apiRange7.3.0-ga1–7.3.7-ga8java

liferay release.portal.apiRange7.2.0–7.2.1-ga2java

Source	Link
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266
github	www.github.com/advisories/GHSA-rwxc-4cmw-7x75

28 Jan 2025 06:56Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4 - 9

EPSS0.00558

SSVC