UpHeron
All vulnerabilities

Servers and applications

CVE-2024-25151

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's…

Severity
Medium 5.4
Published
21 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.2, 7.4.3.4
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.3-service_pack_1
  • Version 7.3-fix_pack_2
  • Version 7.3-fix_pack_1
  • Version 7.3
All 25 release lines
  • Every version before 7.2
  • Version 7.2
  • Version 7.2-fix_pack_1
  • Version 7.2-fix_pack_2
  • Version 7.2-fix_pack_3
  • Version 7.2-fix_pack_4
  • Version 7.2-fix_pack_5
  • Version 7.2-fix_pack_6
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_10
  • Version 7.2-fix_pack_11
  • Version 7.2-fix_pack_12
  • Version 7.2-fix_pack_13
  • Version 7.2-fix_pack_14
  • Version 7.2-service_pack_1
  • Version 7.2-service_pack_2
  • Version 7.2-service_pack_3
  • Version 7.2-service_pack_4
  • Version 7.2-service_pack_5
  • Version 7.3
  • Version 7.3-fix_pack_1
  • Version 7.3-fix_pack_2
  • Version 7.3-service_pack_1
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • From 7.2.0 before 7.4.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-25151
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-25151