CVE-2024-11993 - Vulnerability Details

Vendors	Products
Liferay	Digital Experience Platform Liferay Portal

Link	Providers
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993

Type	Values Removed	Values Added
Description	Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field	Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Type	Values Removed	Values Added
First Time appeared		Liferay Liferay digital Experience Platform Liferay liferay Portal
CPEs		cpe:2.3:a:liferay:digital_experience_platform:::::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:-:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:::::: cpe:2.3:a:liferay:liferay_portal::::::::
Vendors & Products		Liferay Liferay digital Experience Platform Liferay liferay Portal
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field
Weaknesses		CWE-79
References		https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993
Metrics		cvssV4_0 `{'score': 4.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-11993", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2024-11-29T11:32:54.553Z", "datePublished": "2024-12-17T20:24:42.600Z", "dateUpdated": "2025-03-28T20:04:56.591Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.38", "status": "affected", "version": "7.4.0", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.13-u38", "status": "affected", "version": "7.4.13", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Liferay"}, {"lang": "en", "type": "reporter", "value": "milCERT AT"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field<br>"}], "value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 4.6, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-03-28T20:04:56.591Z"}, "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-17T21:24:48.114546Z", "id": "CVE-2024-11993", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-17T21:24:55.247Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-11993 (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

state : PUBLISHED (string)

assignerShortName : Liferay (string)

dateReserved : 2024-11-29T11:32:54.553Z (string)

datePublished : 2024-12-17T20:24:42.600Z (string)

dateUpdated : 2025-03-28T20:04:56.591Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Portal (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.4.3.38 (string)

status : affected (string)

version : 7.4.0 (string)

versionType : maven (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : DXP (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.4.13-u38 (string)

status : affected (string)

version : 7.4.13 (string)

versionType : maven (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : Liferay (string)

}

1 : { »

lang : en (string)

type : reporter (string)

value : milCERT AT (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field<br> (string)

}

]

value : Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field (string)

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 4.6 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : HIGH (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

subIntegrityImpact : LOW (string)

userInteraction : ACTIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2025-03-28T20:04:56.591Z (string)

}

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-12-17T21:24:48.114546Z (string)

id : CVE-2024-11993 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-17T21:24:55.247Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-11993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-17T21:24:48.114546Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-17T21:24:51.944Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Liferay"}, {"lang": "en", "type": "reporter", "value": "milCERT AT"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.38"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.4.13", "versionType": "maven", "lessThanOrEqual": "7.4.13-u38"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field", "supportingMedia": [{"type": "text/html", "value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-03-28T20:04:56.591Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11993", "state": "PUBLISHED", "dateUpdated": "2025-03-28T20:04:56.591Z", "dateReserved": "2024-11-29T11:32:54.553Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2024-12-17T20:24:42.600Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-11993 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-12-17T21:24:48.114546Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-17T21:24:51.944Z (string)

}

]

cna : { »

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : reporter (string)

value : Liferay (string)

}

1 : { »

lang : en (string)

type : reporter (string)

value : milCERT AT (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 4.6 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : ACTIVE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : HIGH (string)

subIntegrityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

vulnConfidentialityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Liferay (string)

product : Portal (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.4.0 (string)

versionType : maven (string)

lessThanOrEqual : 7.4.3.38 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : Liferay (string)

product : DXP (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.4.13 (string)

versionType : maven (string)

lessThanOrEqual : 7.4.13-u38 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2025-03-28T20:04:56.591Z (string)

}

cveMetadata : { »

cveId : CVE-2024-11993 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-28T20:04:56.591Z (string)

dateReserved : 2024-11-29T11:32:54.553Z (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

datePublished : 2024-12-17T20:24:42.600Z (string)

assignerShortName : Liferay (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA343855-76B8-47E3-BBB3-31374B1CD8BA", "versionEndExcluding": "7.4.3.39", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DDBD8B4-51C6-4D66-8B59-E61BEDF90D30", "versionEndExcluding": "7.4", "versionStartIncluding": "7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*", "matchCriteriaId": "96E84DBC-C740-4E23-8D1D-83C8AE49813E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*", "matchCriteriaId": "8B1B2384-764F-43CC-8206-36DCBE9DDCBF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*", "matchCriteriaId": "C7B02106-D5EA-4A59-A959-CCE2AC8F55BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*", "matchCriteriaId": "80204464-5DC5-4A52-B844-C833A96E6BD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*", "matchCriteriaId": "6F8A5D02-0B45-4DA9-ACD8-42C1BFF62827", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*", "matchCriteriaId": "38DA7C99-AC2C-4B9A-B611-4697159E1D79", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*", "matchCriteriaId": "F264AD07-D105-4F00-8920-6D8146E4FA63", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*", "matchCriteriaId": "C929CF16-4725-492A-872B-0928FE388FC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*", "matchCriteriaId": "1B8750A1-E481-48D4-84F4-97D1ABE15B46", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*", "matchCriteriaId": "454F8410-D9AC-481E-841C-60F0DF2CC25E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*", "matchCriteriaId": "D1A442EE-460F-4823-B9EF-4421050F0847", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*", "matchCriteriaId": "608B205D-0B79-4D1C-B2C1-64C31DB1896E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*", "matchCriteriaId": "10B863B8-201D-494C-8175-168820996174", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*", "matchCriteriaId": "4427DC78-E80C-4057-A295-B0731437A99E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*", "matchCriteriaId": "22B6B8C1-1FF3-41BC-9576-16193AE20CC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*", "matchCriteriaId": "DDA17F24-1A7E-4BEB-9C98-41761A2A36A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*", "matchCriteriaId": "3B062851-CE6B-44F4-8222-422EC9872EC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*", "matchCriteriaId": "D4687FDA-0078-4E89-ADD8-7EDDA68261A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*", "matchCriteriaId": "7EA29B09-CC24-4063-96A5-96AA08C0886D", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*", "matchCriteriaId": "331FC246-D3E9-4711-B305-BE51BF743CF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*", "matchCriteriaId": "A5823BC0-8C11-4C31-9E99-3C9D82918E2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*", "matchCriteriaId": "E2E6CB66-1AE1-4626-8070-64C250ED8363", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*", "matchCriteriaId": "B63449AA-6831-4290-B1FA-0BB806820402", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*", "matchCriteriaId": "CBF766CE-CBB8-472A-BAF0-BD39A7BCB4DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*", "matchCriteriaId": "B3B169F6-B8B8-4612-AD7D-F75CC6A9297B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*", "matchCriteriaId": "12D46756-D26D-4877-ACE8-1C2721908428", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*", "matchCriteriaId": "5403DCEF-20C2-4568-8DF1-30804F522915", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*", "matchCriteriaId": "90E39742-90BE-4DEB-AB78-F9B8F7333F9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*", "matchCriteriaId": "9D07DB20-9DCF-4C05-99D2-F6B37A082C14", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*", "matchCriteriaId": "341D1157-8118-4BD3-A902-36E90E066706", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*", "matchCriteriaId": "1AB71307-7EAA-436A-9CBC-5A94F034FB48", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*", "matchCriteriaId": "9446B3A5-6647-416C-92AF-7B6E0E929765", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*", "matchCriteriaId": "06386C7A-CAA1-4FC4-9182-5A66342FB903", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*", "matchCriteriaId": "182FAA46-D9FB-4170-B305-BAD0DF6E5DE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*", "matchCriteriaId": "DF1BB9E6-D690-4C12-AEF0-4BD712869CBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*", "matchCriteriaId": "653A0452-070F-4312-B94A-F5BCB01B9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*", "matchCriteriaId": "15B67345-D0AF-4BFD-A62D-870F75306A4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*", "matchCriteriaId": "DE1F4262-A054-48CC-BF1D-AA77A94FFFE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*", "matchCriteriaId": "D176CECA-2821-49EA-86EC-1184C133C0A3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field"}, {"lang": "es", "value": "La vulnerabilidad de cross-site scripting (XSS) reflejado en Liferay Portal 7.1.0 a 7.4.3.38 y Liferay DXP 7.4 GA a la actualizaci\u00f3n 38, 7.3 GA a la actualizaci\u00f3n 36, 7.2 GA a la actualizaci\u00f3n 20 y 7.1 GA a la actualizaci\u00f3n 28 permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del campo de nombre de Dispatch"}], "id": "CVE-2024-11993", "lastModified": "2025-03-28T20:15:20.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@liferay.com", "type": "Secondary"}]}, "published": "2024-12-17T21:15:07.013", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@liferay.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : DA343855-76B8-47E3-BBB3-31374B1CD8BA (string)

versionEndExcluding : 7.4.3.39 (string)

versionStartIncluding : 7.1.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 9DDBD8B4-51C6-4D66-8B59-E61BEDF90D30 (string)

versionEndExcluding : 7.4 (string)

versionStartIncluding : 7.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* (string)

matchCriteriaId : 96E84DBC-C740-4E23-8D1D-83C8AE49813E (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:* (string)

matchCriteriaId : 8B1B2384-764F-43CC-8206-36DCBE9DDCBF (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:* (string)

matchCriteriaId : C7B02106-D5EA-4A59-A959-CCE2AC8F55BC (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:* (string)

matchCriteriaId : 80204464-5DC5-4A52-B844-C833A96E6BD4 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:* (string)

matchCriteriaId : 6F8A5D02-0B45-4DA9-ACD8-42C1BFF62827 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:* (string)

matchCriteriaId : 38DA7C99-AC2C-4B9A-B611-4697159E1D79 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:* (string)

matchCriteriaId : F264AD07-D105-4F00-8920-6D8146E4FA63 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:* (string)

matchCriteriaId : C929CF16-4725-492A-872B-0928FE388FC9 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:* (string)

matchCriteriaId : 1B8750A1-E481-48D4-84F4-97D1ABE15B46 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:* (string)

matchCriteriaId : 454F8410-D9AC-481E-841C-60F0DF2CC25E (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:* (string)

matchCriteriaId : D1A442EE-460F-4823-B9EF-4421050F0847 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:* (string)

matchCriteriaId : 608B205D-0B79-4D1C-B2C1-64C31DB1896E (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:* (string)

matchCriteriaId : 10B863B8-201D-494C-8175-168820996174 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:* (string)

matchCriteriaId : 4427DC78-E80C-4057-A295-B0731437A99E (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* (string)

matchCriteriaId : 22B6B8C1-1FF3-41BC-9576-16193AE20CC7 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:* (string)

matchCriteriaId : DDA17F24-1A7E-4BEB-9C98-41761A2A36A2 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:* (string)

matchCriteriaId : 3B062851-CE6B-44F4-8222-422EC9872EC3 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:* (string)

matchCriteriaId : D4687FDA-0078-4E89-ADD8-7EDDA68261A4 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:* (string)

matchCriteriaId : 7EA29B09-CC24-4063-96A5-96AA08C0886D (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:* (string)

matchCriteriaId : 331FC246-D3E9-4711-B305-BE51BF743CF7 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:* (string)

matchCriteriaId : A5823BC0-8C11-4C31-9E99-3C9D82918E2A (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:* (string)

matchCriteriaId : E2E6CB66-1AE1-4626-8070-64C250ED8363 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:* (string)

matchCriteriaId : B63449AA-6831-4290-B1FA-0BB806820402 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:* (string)

matchCriteriaId : CBF766CE-CBB8-472A-BAF0-BD39A7BCB4DE (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:* (string)

matchCriteriaId : B3B169F6-B8B8-4612-AD7D-F75CC6A9297B (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:* (string)

matchCriteriaId : 12D46756-D26D-4877-ACE8-1C2721908428 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:* (string)

matchCriteriaId : 5403DCEF-20C2-4568-8DF1-30804F522915 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:* (string)

matchCriteriaId : 90E39742-90BE-4DEB-AB78-F9B8F7333F9A (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* (string)

matchCriteriaId : 9D07DB20-9DCF-4C05-99D2-F6B37A082C14 (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:* (string)

matchCriteriaId : 341D1157-8118-4BD3-A902-36E90E066706 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* (string)

matchCriteriaId : 1AB71307-7EAA-436A-9CBC-5A94F034FB48 (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:* (string)

matchCriteriaId : 9446B3A5-6647-416C-92AF-7B6E0E929765 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:* (string)

matchCriteriaId : 06386C7A-CAA1-4FC4-9182-5A66342FB903 (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:* (string)

matchCriteriaId : 182FAA46-D9FB-4170-B305-BAD0DF6E5DE9 (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:* (string)

matchCriteriaId : DF1BB9E6-D690-4C12-AEF0-4BD712869CBA (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:* (string)

matchCriteriaId : 653A0452-070F-4312-B94A-F5BCB01B9BDC (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:* (string)

matchCriteriaId : 15B67345-D0AF-4BFD-A62D-870F75306A4F (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:* (string)

matchCriteriaId : DE1F4262-A054-48CC-BF1D-AA77A94FFFE4 (string)

vulnerable : true (boolean)

}

39 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:* (string)

matchCriteriaId : D176CECA-2821-49EA-86EC-1184C133C0A3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de cross-site scripting (XSS) reflejado en Liferay Portal 7.1.0 a 7.4.3.38 y Liferay DXP 7.4 GA a la actualización 38, 7.3 GA a la actualización 36, 7.2 GA a la actualización 20 y 7.1 GA a la actualización 28 permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarios a través del campo de nombre de Dispatch (string)

}

]

id : CVE-2024-11993 (string)

lastModified : 2025-03-28T20:15:20.400 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 4.6 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirement : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubAvailabilityImpact : NOT_DEFINED (string)

modifiedSubConfidentialityImpact : NOT_DEFINED (string)

modifiedSubIntegrityImpact : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnAvailabilityImpact : NOT_DEFINED (string)

modifiedVulnConfidentialityImpact : NOT_DEFINED (string)

modifiedVulnIntegrityImpact : NOT_DEFINED (string)

privilegesRequired : HIGH (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

subIntegrityImpact : LOW (string)

userInteraction : ACTIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

source : security@liferay.com (string)

type : Secondary (string)

}

]

}

published : 2024-12-17T21:15:07.013 (string)

references : [ »

0 : { »

source : security@liferay.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993 (string)

}

]

sourceIdentifier : security@liferay.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : security@liferay.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object