CVE-2024-25602

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.2 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 17

Description A stored cross-site scripting (XSS) issue exists in the Users Admin module's edit user page, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization's Name text field.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.2, update to a version outside of this range or apply the necessary fix. For Liferay DXP 7.3, apply service pack 3 or later. For Liferay DXP 7.2, apply fix pack 17 or later. As a temporary workaround, consider restricting access to the Users Admin module's edit user page to minimize the risk of exploitation.