CVE-2024-25603

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-25603
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-25603.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-25603
Aliases
Published
2024-02-21T03:15:09Z
Modified
2026-05-18T05:58:48Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "fixed":  "7.2"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-NA"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_10"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_11"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_12"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_13"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_14"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_15"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_16"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_2"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_3"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_4"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_5"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_6"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_7"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_8"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-fix_pack_9"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-service_pack_2"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-service_pack_3"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-service_pack_4"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.2-service_pack_5"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.3-NA"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "last_affected":  "7.4-NA"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "cpe":  "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
            "extracted_events":  [
                {
                    "introduced":  "7.2.0"
                },
                {
                    "fixed":  "7.4.3.5"
                }
            ],
            "source":  "CPE_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ded0e9390637985231e962e4ad4cfa4639eabb26
Last Affected
4ffdd7225ef4a5fd922703263a3006a741a4d8d0
Last Affected
0515646c8f638f202d107469cc147172fc7685de
Last Affected
77b773677e0fa17b1a869414ad66220245ba96a8
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
        "cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*",
        "cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*",
        "cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*",
        "cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*",
        "cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "7.2-fix_pack_1"
        },
        {
            "last_affected":  "7.2-service_pack_1"
        },
        {
            "last_affected":  "7.3-fix_pack_1"
        },
        {
            "last_affected":  "7.3-fix_pack_2"
        },
        {
            "last_affected":  "7.3-service_pack_1"
        },
        {
            "last_affected":  "7.3-service_pack_3"
        }
    ],
    "source":  "CPE_FIELD"
}

Affected versions

6.*
6.1.0-b1
6.1.0-b2
6.1.0-b3
6.1.0-b4
6.1.0-rc1
6.2.0-b1
6.2.0-b2
6.2.0-m2
6.2.0-m3
6.2.0-m4
6.2.0-m5
6.2.0-m6
7.*
7.0.0-m1
7.0.0-m2
7.0.0-m3
7.0.0-m4
7.0.0-m5
7.1.0-a1
7.1.0-a2
7.1.0-b1
7.1.0-b2
7.1.0-m1
7.1.0-m2
7.2.0-a1
7.2.0-b1
7.2.0-b2
7.2.0-b3
7.2.0-ga1
7.2.0-m2
7.2.0-rc2
7.2.0-rc3
7.2.1-ga2
7.3.0-ga1
7.3.1-ga2
7.3.2-ga3
7.3.3-ga4
sync-3.*
sync-3.0.0-b1
sync-3.0.1-b2
sync-3.0.10-ga2
sync-3.0.2-b3
sync-3.0.3-b4
sync-3.0.4-b5
sync-3.0.5-b6
sync-3.0.6-b7
sync-3.0.7-b8
sync-3.0.8-b9
sync-3.0.9-ga1
sync-3.1.0-ga1
Other
test-fix-pack-base-7310

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-25603.json"