Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

Affected Packages

Maven com.liferay.portal:release.portal.bom

Affected versions: 7.2.0 (fixed in 7.4.3.38)

Maven com.liferay.portal:release.dxp.bom

Affected versions: 7.4.13.u1 (fixed in 7.4.13.u38)

Maven com.liferay.portal:release.dxp.bom

Affected versions: 7.3.10.ep3 (fixed in 7.3.10.u11)

Maven com.liferay.portal:release.dxp.bom

Affected versions: 7.2.0 (fixed in 7.2.10.fp20)

Related CVEs

CVE-2024-26269

Key Information

GHSA ID

GHSA-rwhv-hvj2-qrqm

Published

February 21, 2024 3:30 AM

Last Modified

January 28, 2025 3:04 PM

CVSS Score

9.0 /10

Primary Ecosystem

Maven

Primary Package

com.liferay.portal:release.portal.bom

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.