CVE-2024-25147 CRITICAL

CVE-2024-25147

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published February 21, 2024
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.

Key dates

02Disclosure timeline

February 21, 2024 CVE published
April 22, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-25426 Comodo Dome Firewall 2.7.0 Cross-Site Scripting via dnsmasq CVE-2025-10614 itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting CVE-2024-47103 IBM Sterling B2B Integrator cross-site scripting CVE-2025-6696 LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scripting CVE-2023-34012 WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)