Cross-Site Scripting Vulnerability in Liferay Portal and DXP Products

CVE-2024-11993

What is CVE-2024-11993?

CVE-2024-11993 is a reflected cross-site scripting (XSS) vulnerability identified in Liferay Portal versions 7.1.0 to 7.4.3.38 and Liferay DXP updates. This vulnerability allows remote attackers to execute arbitrary web scripts or HTML through the Dispatch name field. Successful exploitation could lead to unauthorized actions and data exposure, presenting severe security risks for applications leveraging affected versions of these products. It is crucial for organizations using Liferay technologies to implement security patches promptly and to review their application code for potential exposure to this vulnerability.

References