UpHeron
All vulnerabilities

Servers and applications

CVE-2024-25145

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result…

Severity
Medium 5.4
Published
7 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.2, 7.4.3.12
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.2-fix_pack_15
  • Version 7.2-fix_pack_14
  • Version 7.2-fix_pack_13
  • Version 7.2-fix_pack_12
All 17 release lines
  • Every version before 7.2
  • Version 7.2
  • Version 7.2-fix_pack_1
  • Version 7.2-fix_pack_2
  • Version 7.2-fix_pack_3
  • Version 7.2-fix_pack_4
  • Version 7.2-fix_pack_5
  • Version 7.2-fix_pack_6
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_10
  • Version 7.2-fix_pack_11
  • Version 7.2-fix_pack_12
  • Version 7.2-fix_pack_13
  • Version 7.2-fix_pack_14
  • Version 7.2-fix_pack_15
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • Every version up to 7.2.1
  • From 7.3.0 up to 7.3.7
  • From 7.4.0 before 7.4.3.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-25145
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-25145