Description

The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.

Remediation

References

CVE-2024-25144

Related Vulnerabilities

WordPress Plugin BadgeOS SQL Injection (3.7.0)

WordPress Plugin Maps Widget for Google Maps-Google Maps Builder Security Bypass (4.16)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0307)

WordPress Plugin Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Cross-Site Scripting (2.2.0)

Microsoft SQL Server Other Vulnerability (CVE-2000-1087)

Severity

Medium

Classification

CVE-2024-25144 CWE-834 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities