CVE-2024-26269 — Cross-site Scripting in Digital Experience Platform

CWE-79 — Cross-site ScriptingCWE-862 — Missing Authorization5 documents4 sources
Severity
6.1MEDIUMNVD
CNA9.6GHSA7.8
EPSS
0.2%
top 58.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedFeb 21
Latest updateApr 22

Description

Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDliferay/liferay_portal7.2.0 — 7.4.3.38
▶CVEListV5liferay/portal7.2.0 — 7.4.3.37
▶CVEListV5liferay/dxp7.4.13 — 7.4.13.u37+2

🔴Vulnerability Details

4
GHSA
Ant Media Server vulnerable to a local privilege escalation↗2024-04-22
▶
GHSA
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting↗2024-02-21
▶
OSV
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting↗2024-02-21
▶
CVEList
CVE-2024-26269: Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet↗2024-02-21
▶
CVE-2024-26269 — Cross-site Scripting | cvebase