Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Liferay DXP Insecure Default Initialization of Resource Vulnerability - CVE-2024-25610 - Vulnerability Database
Liferay DXP

Liferay DXP Insecure Default Initialization of Resource Vulnerability - CVE-2024-25610

Medium
Reference: CVE-2024-25610
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-25610
Title: Liferay DXP Insecure Default Initialization of Resource Vulnerability
Overview:

In Liferay Portal 7.2.0 through 7.4.3.12 and older unsupported versions and Liferay DXP 7.4 before update 9 7.3 before update 4 7.2 before fix pack 19 and older unsupported versions the default configuration does not sanitize blog entries of JavaScript which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entrys content text field.