Description

Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.

Remediation

References

CVE-2024-25603

Related Vulnerabilities

WordPress Plugin Border Loading Bar Multiple Cross-Site Scripting Vulnerabilities (1.0)

WordPress Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2007-6013)

Drupal Core 9.0.x Information Disclosure (9.0.0 - 9.0.5)

WordPress Plugin YaySMTP-Simple WP SMTP Mail Cross-Site Scripting (2.2)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23214)

Severity

Medium

Classification

CVE-2024-25603 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities