WaratekVRT Sign in

CVE-2024-25151 Liferay Portal

Affected softwareLiferay Portal
Severity5.4 Medium CVSS 3.1 2 scores
Fixed in7.4.3.4
WeaknessCross-site scripting (CWE-79)
Published21 Feb 2024
Updated17 Jun 2026

Description

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.47% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Medium or Low severity, no CISA or VulnCheck KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory
Finding This CVE is MEDIUM severity, is not listed in CISA KEV or VulnCheck KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain.

CVSS

5.4 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N security@liferay.com Secondary published
CVSS 3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.liferay.portal:release.portal.bom 0 7.4.3.4 unbounded
com.liferay.portal:release.dxp.bom 7.3.0 7.3.10.u4 unbounded
com.liferay.portal:release.dxp.bom 7.2.0 7.2.10.fp15 unbounded

Products and versions

4 products, 29 version entries
SourceVendorProductSchemeAffected versions
osv com.liferay.portal release.dxp.bom generic ≥ 7.2.0 and ＜ 7.2.10.15 · ≥ 7.3.0 and ＜ 7.3.10.4
osv com.liferay.portal release.portal.bom generic ＜ 7.4.3.4
nvd liferay digital experience platform generic 7.2 · ＜ 7.2 · 7.2:fix_pack_1 · 7.2:service_pack_1 · 7.2:fix_pack_2 · 7.2:service_pack_2 · 7.2:fix_pack_3 · 7.2:service_pack_3 · 7.2:fix_pack_4 · 7.2:service_pack_4 · 7.2:fix_pack_5 · 7.2:service_pack_5 · 7.2:fix_pack_6 · 7.2:fix_pack_7 · 7.2:fix_pack_8 · 7.2:fix_pack_9 · 7.2:fix_pack_10 · 7.2:fix_pack_11 · 7.2:fix_pack_12 · 7.2:fix_pack_13 · 7.2:fix_pack_14 · 7.3 · 7.3:fix_pack_1 · 7.3:service_pack_1 · 7.3:fix_pack_2
nvd liferay liferay portal generic ≥ 7.2.0 and ＜ 7.4.3.4

References

URLTags
https://github.com/liferay/liferay-portal PACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151 WEB

Timeline
Published2024-02-21By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.