Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pac

Successful exploitation of CVE-2024-26269 allows an attacker to inject malicious JavaScript code into a Liferay Portal page viewed by other users. This can lead to a variety of attacks, including session hijacking, credential theft, and defacement of the portal. The attacker could potentially gain complete control over user accounts, access sensitive data, and even compromise the entire Liferay instance. The anchor (hash) portion of a URL is the attack vector, making it relatively easy to craft malicious links and distribute them to unsuspecting users. This vulnerability is particularly concerning given Liferay's widespread use in enterprise environments, where sensitive data and critical business processes are often managed.

Organizations using Liferay Portal and DXP versions 7.2.0 through 7.4.3.37 are at risk. This includes businesses relying on Liferay for content management, collaboration, and digital experience delivery. Shared hosting environments where multiple customers share the same Liferay instance are particularly vulnerable, as an attacker could potentially compromise other tenants.

• linux / server:

journalctl -u liferay-portal | grep -i 'script' -i 'html'

• generic web:

curl -I https://your-liferay-portal/some/page#<script>alert('XSS')</script> | grep -i 'content-type'

• wordpress / composer / npm: (Not applicable, as Liferay is not a WordPress/Composer/npm component) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability is in the frontend JS) • windows / supply-chain: (Not applicable, as Liferay is a Java application)

1. 2024-02-21Disclosure

   disclosure

2. 2024-02-21Patch

   patch

1. Reserviert2024-02-15
2. Veröffentlicht2024-02-21
3. Geändert2025-04-22
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-26269 is to upgrade Liferay Portal to version 7.4.4 or later. If immediate upgrading is not possible, consider implementing temporary workarounds. Input validation and output encoding on the affected portlet.js component can help reduce the attack surface, though this is not a substitute for patching. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly unusual JavaScript execution patterns or attempts to access sensitive data.