← CVE Intelligence

CVE-2024-25144

Liferay / Portal PUBLISHED

Description (CNA)

The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

Affected (CNA)

Vendor / productVersions
Liferay / Portalaffected 7.2.0 through 7.4.3.26
Liferay / DXPaffected 7.4.13 through 7.4.13.u26; affected 7.3.10 through 7.3.10.u5; affected 7.2.10 through 7.2.10-dxp-18

CWE

CWE-835

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.