Liferay Portal 和 Liferay DXP 存在存储型跨站脚本 (Cross-site Scripting) 漏洞
平台
java
组件
com.liferay.portal:release.portal.bom
修复版本
7.4.4
7.4.14
7.3.11
7.2.11
7.4.3.14
CVE-2024-26266 describes multiple stored cross-site scripting (XSS) vulnerabilities affecting Liferay Portal versions 7.2.0 through 7.4.3.13, and older unsupported versions, as well as Liferay DXP versions prior to update 10. An attacker can inject arbitrary web script or HTML by crafting a payload within the first, middle, or last name fields of a user creating entries in the Announcement or Alerts widgets. Affected versions include Liferay Portal 7.2 before fix pack 17. The vulnerability is resolved in Liferay Portal 7.4.3.14.
检测此 CVE 是否影响你的项目
上传你的 pom.xml 文件，立即知道是否受影响。
影响与攻击场景翻译中…
Successful exploitation of CVE-2024-26266 allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser session. This can lead to account takeover, data theft (including sensitive user information stored within Liferay), and defacement of the Liferay Portal instance. The attacker could potentially leverage this to move laterally within the network if the compromised user has elevated privileges or access to other systems. The impact is particularly severe given the widespread use of Liferay Portal in enterprise environments, often handling critical business data and processes.
利用背景翻译中…
CVE-2024-26266 was publicly disclosed on February 21, 2024. No known public exploits or active campaigns have been reported at the time of writing, but the CRITICAL severity and ease of exploitation suggest that it is likely to become a target. The vulnerability is not currently listed on CISA KEV. Given the widespread use of Liferay Portal, organizations are strongly encouraged to prioritize patching.
哪些人处于风险中翻译中…
Organizations utilizing Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP versions prior to update 10 are at risk. This includes businesses relying on Liferay for content management, intranet portals, and customer experience platforms. Shared hosting environments where multiple users have access to create content within Liferay are particularly vulnerable.
检测步骤翻译中…
• linux / server:
journalctl -u liferay-portal | grep -i "XSS"• generic web:
curl -I https://<liferay_portal_url>/ | grep -i "X-XSS-Protection"• wordpress / composer / npm: (Not applicable as Liferay is not a WordPress/Composer/npm component) • database (mysql, redis, mongodb, postgresql): (Not applicable as the vulnerability is not directly related to the database) • windows / supply-chain: (Not applicable as Liferay is not a Windows/supply-chain component)
攻击时间线
- Disclosure
disclosure
- Patch
patch
威胁情报
漏洞利用状态
EPSS
0.15% (36% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 已改变 — 攻击可以超出脆弱组件，影响其他系统。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 高 — 攻击者可写入、修改或删除任何数据。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2024-26266 is to upgrade Liferay Portal to version 7.4.3.14 or later, or to Liferay DXP to update 10 or later. If immediate upgrading is not possible, consider implementing strict input validation and output encoding on user-supplied data within the Announcement and Alerts widgets. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Liferay logs for suspicious activity, particularly related to user profile updates and widget creation. Review user access controls to limit the number of users with the ability to create entries in these widgets.
修复方法
升级到 Liferay Portal 可用的最新版本。对于 Liferay DXP，升级到 7.4 Update 10、7.3 Update 4 或 7.2 Fix Pack 17 或更高版本。这将修复存储型跨站脚本 (XSS) 漏洞。
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2024-26266 — XSS in Liferay Portal 7.4?
CVE-2024-26266 is a critical stored cross-site scripting (XSS) vulnerability in Liferay Portal and DXP versions allowing attackers to inject malicious scripts through user name fields in widgets.
Am I affected by CVE-2024-26266 in Liferay Portal 7.4?
You are affected if you are running Liferay Portal versions 7.2.0 through 7.4.3.13, or older unsupported versions, and Liferay DXP versions prior to update 10.
How do I fix CVE-2024-26266 in Liferay Portal 7.4?
Upgrade to Liferay Portal 7.4.3.14 or later, or to Liferay DXP update 10 or later. Consider input validation and WAF rules as temporary mitigations.
Is CVE-2024-26266 being actively exploited?
No active exploitation has been confirmed, but the CRITICAL severity suggests it is a likely target.
Where can I find the official Liferay advisory for CVE-2024-26266?
Refer to the official Liferay security advisory: [https://liferay.com/security-advisories/liferay-portal-dxp-74-3-14-and-liferay-dxp-73-4-released](https://liferay.com/security-advisories/liferay-portal-dxp-74-3-14-and-liferay-dxp-73-4-released)