Detections
Analytics

Liferay Portal 7.4.x < 7.4.3.14 XSS

critical Nessus Plugin ID 190931

Language:

Synopsis

The remote host is missing a security update.

Description

The version of Liferay Portal installed on the remote host is prior to 7.4.3.14. It is, therefore, affected by a vulnerability as referenced in the advisory.

 - Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget. (CVE-2024-26266)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade Liferay Portal based upon the guidance specified in the advisory.

See Also

https://liferay.dev/portal/security/known-vulnerabilities

Plugin Details

Severity: Critical

ID: 190931

File Name: liferay_7_4_3_14.nasl

Version: 1.0

Type: remote

Family: CGI abuses

Published: 2/23/2024

Updated: 2/23/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-26266

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:liferay:liferay_portal

Required KB Items: installed_sw/liferay_portal

Exploit Ease: No known exploits are available

Patch Publication Date: 2/21/2024

Vulnerability Publication Date: 2/21/2024

Reference Information

CVE: CVE-2024-26266

IAVA: 2024-A-0115