DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Liferay Liferay Portal und DXP: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-02-07
Ein entfernter Angreifer kann mehrere Schwachstellen in Liferay Liferay Portal und Liferay Liferay DXP ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting (XSS)-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-29050US | — | — | ||
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows re… | ||||
| CVE-2021-29038US | — | — | ||
Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate… | ||||
| CVE-2024-25148US | high8.1 | — | ||
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUs… | ||||
| CVE-2024-25146US | medium5.3 | — | ||
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with d… | ||||
| CVE-2024-25144US | medium6.5 | — | ||
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and o… | ||||
| CVE-2023-47798US | medium4.6 | — | ||
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate exi… | ||||
| CVE-2024-25145US | medium5.4 | — | ||
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Lifera… | ||||
| CVE-2024-25143US | medium6.5 | — | ||
The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older un… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
- Liferay Known Vulnerabilities vom 2024-02-07external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan