GHSA-w275-m8cr-hf2v

ghsaUSosv

Liferay Portal denial-of-service vulnerability

view advisory published 2024-02-08Licence: CC-BY-4.0

The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-25144US	medium6.5	0.57% (47th)	—	2024-02-08
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and o…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-25144ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan