CVE-2024-25152: liferay portal +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-25152

CVSS 5.4 · Medium EPSS 0,56%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada liferay portal, liferay digital experience platform. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.

Rincian

Terbit di NVD: 21 Februari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,56% peluang dieksploitasi; lebih tinggi dari 44,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
liferay	liferay portal	Semua versi sebelum 7.4.3.4
liferay	digital experience platform	Semua versi sebelum 7.2
liferay	digital experience platform	Versi 7.2
liferay	digital experience platform	Versi 7.2 fix_pack_1
liferay	digital experience platform	Versi 7.2 fix_pack_10
liferay	digital experience platform	Versi 7.2 fix_pack_11
liferay	digital experience platform	Versi 7.2 fix_pack_12
liferay	digital experience platform	Versi 7.2 fix_pack_13
liferay	digital experience platform	Versi 7.2 fix_pack_14
liferay	digital experience platform	Versi 7.2 fix_pack_15
liferay	digital experience platform	Versi 7.2 fix_pack_16
liferay	digital experience platform	Versi 7.2 fix_pack_2
liferay	digital experience platform	Versi 7.2 fix_pack_3
liferay	digital experience platform	Versi 7.2 fix_pack_4
liferay	digital experience platform	Versi 7.2 fix_pack_5
liferay	digital experience platform	Versi 7.2 fix_pack_6
liferay	digital experience platform	Versi 7.2 fix_pack_7
liferay	digital experience platform	Versi 7.2 fix_pack_8
liferay	digital experience platform	Versi 7.2 fix_pack_9
liferay	digital experience platform	Versi 7.2 service_pack_1
liferay	digital experience platform	Versi 7.2 service_pack_2
liferay	digital experience platform	Versi 7.2 service_pack_3
liferay	digital experience platform	Versi 7.2 service_pack_4
liferay	digital experience platform	Versi 7.2 service_pack_5
liferay	digital experience platform	Versi 7.3
liferay	digital experience platform	Versi 7.3 fix_pack_1
liferay	digital experience platform	Versi 7.3 fix_pack_2
liferay	digital experience platform	Versi 7.3 service_pack_1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.