CVE-2024-25147

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25147", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2024-02-06T10:32:42.567Z", "datePublished": "2024-02-21T01:16:21.256Z", "dateUpdated": "2025-04-22T16:25:59.509Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.2.0", "versionType": "maven"}]}, {"defaultStatus": "unknown", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.3.10-dxp-2", "status": "affected", "version": "7.3.10", "versionType": "maven"}, {"lessThanOrEqual": "7.2.10-dxp-14", "status": "affected", "version": "7.2.10", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links."}], "value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-21T01:16:21.256Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "liferay", "product": "portal", "cpes": ["cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.2.0", "status": "affected", "lessThanOrEqual": "7.4.1", "versionType": "maven"}]}, {"vendor": "liferay", "product": "dxp", "cpes": ["cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.3.10", "status": "affected", "lessThanOrEqual": "7.3.10-dxp-2", "versionType": "maven"}, {"version": "7.2.10", "status": "affected", "lessThanOrEqual": "7.2.10-dxp-14", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-02-21T16:15:43.147628Z", "id": "CVE-2024-25147", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T16:25:59.509Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.759Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.759Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-21T16:15:43.147628Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"], "vendor": "liferay", "product": "portal", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "maven", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"], "vendor": "liferay", "product": "dxp", "versions": [{"status": "affected", "version": "7.3.10", "versionType": "maven", "lessThanOrEqual": "7.3.10-dxp-2"}, {"status": "affected", "version": "7.2.10", "versionType": "custom", "lessThanOrEqual": "7.2.10-dxp-14"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-26T16:47:42.649Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "maven", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unknown"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.3.10", "versionType": "maven", "lessThanOrEqual": "7.3.10-dxp-2"}, {"status": "affected", "version": "7.2.10", "versionType": "maven", "lessThanOrEqual": "7.2.10-dxp-14"}], "defaultStatus": "unknown"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.", "supportingMedia": [{"type": "text/html", "value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-21T01:16:21.256Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25147", "state": "PUBLISHED", "dateUpdated": "2025-04-22T16:25:59.509Z", "dateReserved": "2024-02-06T10:32:42.567Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2024-02-21T01:16:21.256Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.2.0", "versionType": "maven"}]}, {"defaultStatus": "unknown", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.3.10-dxp-2", "status": "affected", "version": "7.3.10", "versionType": "maven"}, {"lessThanOrEqual": "7.2.10-dxp-14", "status": "affected", "version": "7.2.10", "versionType": "maven"}]}], "source": "security@liferay.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "portal", "vendor": "liferay", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.2.0", "versionType": "maven"}]}, {"cpes": ["cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "dxp", "vendor": "liferay", "versions": [{"lessThanOrEqual": "7.3.10-dxp-2", "status": "affected", "version": "7.3.10", "versionType": "maven"}, {"lessThanOrEqual": "7.2.10-dxp-14", "status": "affected", "version": "7.2.10", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "69440C19-B9E7-41F3-B731-B5C7E37C718A", "versionEndExcluding": "7.4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF8EBC77-BA94-4AA8-BAF0-D1E3C9146459", "versionEndExcluding": "7.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*", "matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*", "matchCriteriaId": "E7E68DF8-749B-4284-A7C9-929701A86B36", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*", "matchCriteriaId": "340DF1FE-5720-4516-BA51-F2197A654409", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*", "matchCriteriaId": "97E155DE-05C6-4559-94A8-0EFEB958D0C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*", "matchCriteriaId": "0635FB5F-9C90-49C7-A9EF-00C0396FCCAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*", "matchCriteriaId": "77523B76-FC26-41B1-A804-7372E13F4FB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*", "matchCriteriaId": "B15397B8-5087-4239-AE78-D3C37D59DE83", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*", "matchCriteriaId": "7CECAA19-8B7F-44C8-8059-6D4F2105E196", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*", "matchCriteriaId": "68CBCEEB-7C28-4769-813F-3F01E33D2E08", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*", "matchCriteriaId": "C0CB4927-A361-4DFA-BDB8-A454EA2894AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*", "matchCriteriaId": "B2B771B7-D5CB-4778-A3A8-1005E4EE134C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*", "matchCriteriaId": "3B9DB383-3791-4A43-BA4D-7695B203E736", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*", "matchCriteriaId": "13F02D77-20E9-4F32-9752-511EB71E6704", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*", "matchCriteriaId": "6353CC8F-A6D4-4A0C-8D68-290CD8DEB4F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*", "matchCriteriaId": "759DDB90-6A89-4E4F-BD04-F70EFA5343B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*", "matchCriteriaId": "43F61E2F-4643-4D5D-84DB-7B7B6E93C67B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*", "matchCriteriaId": "8B057D81-7589-4007-9A0D-2D302B82F9CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*", "matchCriteriaId": "6F0F2558-6990-43D7-9FE2-8E99D81B8269", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*", "matchCriteriaId": "11072673-C3AB-42EA-A26F-890DEE903D42", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*", "matchCriteriaId": "134560B0-9746-4EC3-8DE3-26E53E2CAC6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*", "matchCriteriaId": "6F6A98ED-E694-4F39-95D0-C152BD1EC115", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*", "matchCriteriaId": "2CD6861A-D546-462F-8B22-FA76A4AF8A9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*", "matchCriteriaId": "324BB977-5AAC-4367-98FC-605FF4997B3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*", "matchCriteriaId": "2BBA40AC-4619-434B-90CF-4D29A1CA6D86", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links."}, {"lang": "es", "value": "Vulnerabilidad de Cross-site scripting (XSS) en HtmlUtil.escapeJsLink en Liferay Portal 7.2.0 a 7.4.1 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior al service pack 3, 7.2 anterior al fix pack 15 y versiones anteriores no compatibles, permite a atacantes remotos para inyectar script web o HTML arbitrarias a trav\u00e9s de enlaces de estilo javascript: manipulados."}], "id": "CVE-2024-25147", "lastModified": "2026-06-17T07:15:36.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security@liferay.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-25147", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-02-21T16:15:43.147628Z", "version": "2.0.3"}}]}, "published": "2024-02-21T02:15:29.750", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@liferay.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}