Sign In

CVE-2024-25151

📊 5.4 MEDIUM⚡ 0.4%🎯 0 exploits
📅 Published Feb 21, 2024
📋 Status: Analyzed

The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.

🎯 Affected Products & Systems

26 product configurations affected

Filter by type:
📱
liferay / liferay portal
Application
Vulnerable
Version: ≥ 7.2.0 ∧ < 7.4.3.4
CPE:
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
📱
Vulnerable
Version: < 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*
📱
Vulnerable
Version: 7.2
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*
📱
Vulnerable
Version: 7.3
CPE:
cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*
26 products•scroll for more
Metrics
5.4 MEDIUMCVSS v3.1[email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector:
NETWORK
Complexity:
LOW
Privileges:
LOW
User Interaction:
REQUIRED
Confidentiality:
LOW
Integrity:
LOW
Availability:
NONE
Scope:
CHANGED

🔍 Technical Details

Analysis Status
Analyzed
CVSS Details
5.4 (MEDIUM)v3.1
Source: [email protected]
EPSS Details
0.4% (Minimal)57.9th percentile
Last updated: Nov 1, 2025
Exploitation probability within 30 days
Published Date
Feb 21, 2024 (1 year ago)
Last Modified
Jan 28, 2025 (9 months ago)
Security Weaknesses2
References2