rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. As a workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, as well as browsers and utilities that enforce CORS policies, are not affected by this.
Problem types: cwe_id: CWE-346
description: CWE-346: Origin Validation Error
cwe_id: CWE-942
description: CWE-942: Permissive Cross-domain Policy with Untrusted Domains
Affected products: vendor: gofiber
product: fiber
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-02-21T21:01:44.672Z
CVE-2024-25125 Absolute path traversal vulnerability in digdag server
Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to information disclosure and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: treasure-data
product: digdag
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-14T01:12:05.181Z
CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Problem types: cwe_id: CWE-1333
description: CWE-1333: Inefficient Regular Expression Complexity
Affected products: vendor: rack
product: rack
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-02-28T23:28:07.073Z
CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID 
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: dpgaspar
product: Flask-AppBuilder
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2024-02-28T15:30:27.705Z
CVE-2024-25129 Limited data exfiltration in CodeQL CLI
The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable version of the CLI is used to process either a maliciously modified CodeQL database, or a specially prepared set of QL query sources, the CLI can be made to make an outgoing HTTP request to an URL that contains material read from a local file chosen by the attacker. This may result in a loss of privacy of exfiltration of secrets. Security researchers and QL authors who receive databases or QL source files from untrusted sources may be impacted. A single untrusted `.ql` or `.qll` file cannot be affected, but a zip archive or tarball containing QL sources may unpack auxiliary files that will trigger an attack when CodeQL sees them in the file system. Those using CodeQL for routine analysis of source trees with a preselected set of trusted queries are not affected. In particular, extracting XML files from a source tree into the CodeQL database does not make one vulnerable. The problem is fixed in release 2.16.3 of the CodeQL CLI. Other than upgrading, workarounds include not accepting CodeQL databases or queries from untrusted sources, or only processing such material on a machine without an Internet connection. Customers who use older releases of CodeQL for security scanning in an automated CI system and cannot upgrade for compliance reasons can continue using that version. That use case is safe. If such customers have a private query pack and use the `codeql pack create` command to precompile them before using them in the CI system, they should be using the production CodeQL release to run `codeql pack create`. That command is safe as long as the QL source it precompiled is trusted. All other development of the query pack should use an upgraded CLI.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: github
product: codeql-cli-binaries
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Published: 2024-02-22T18:23:33.228Z
CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Enalean
product: tuleap
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2024-02-22T18:29:10.138Z
CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation
A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.
Problem types: cwe_id: CWE-20
description: Improper Input Validation
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Thibault Guittet (Red Hat).
Published: 2024-12-19T14:18:05.194Z
CVE-2024-25132 Openshift-dedicated: hive: hibernation controller denial of service
A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with the spec.installed field set to true, regardless of the installation status, and a positive timespan for the spec.hibernateAfter value. If a ClusterSync.hiveinternal.openshift.io/v1alpha1 resource is also created, the hive hibernation controller will enter the reconciliation loop leading to a panic when accessing a non-existing field in the ClusterDeployment’s status section, resulting in a denial of service.
Problem types: cwe_id: CWE-400
description: Uncontrolled Resource Consumption
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This issue was discovered by Thibault Guittet (Red Hat).
Published: 2025-03-19T17:57:14.659Z
CVE-2024-25133 Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation
A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.
Problem types: cwe_id: CWE-284
description: Improper Access Control
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This issue was discovered by Thibault Guittet (Red Hat).
Published: 2024-12-31T14:25:19.455Z
CVE-2024-25136 AutomationDirect C-MORE EA9 HMI Path Traversal

There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content.


Problem types: cwe_id: CWE-22
description: CWE-22 Path Traversal
Affected products: vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T6CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T7CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA0-T7CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T8CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10WCL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T12CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-RHMI
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-PGMSW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA.
Published: 2024-03-26T22:53:41.589Z
CVE-2024-25137 AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow

In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions.


Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T6CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T7CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA0-T7CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T8CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10WCL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T12CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-RHMI
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-PGMSW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA.
Published: 2024-03-26T22:58:44.753Z
CVE-2024-25138 AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password

In AutomationDirect C-MORE EA9 HMI, 

credentials used by the platform are stored as plain text on the device.


Problem types: cwe_id: CWE-256
description: CWE-256
Affected products: vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T6CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T7CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA0-T7CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T8CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T10WCL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T12CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-T15CL-R
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-RHMI
default_status: unaffected
vendor: AutomationDirect
product: C-MORE EA9 HMI EA9-PGMSW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Tomer Goldschmidt of Claroty Research - Team82 reported these vulnerabilities to CISA.
Published: 2024-03-26T23:01:40.197Z
CVE-2024-25139 
In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. This is fixed in ER605(UN)_v2_2.2.4 Build 020240119.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-14T00:00:00.000Z
CVE-2024-25140 
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were to be compromised. NOTE: the vendor's position is "we do not have EV cert, so we use test cert as a workaround." Insertion into Trusted Root Certification Authorities was the originally intended behavior, and the UI ensured that the certificate installation step (checked by default) was visible to the user before proceeding with the product installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented.
Users are recommended to upgrade to version 4.0.0, which fixes this issue.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Mongo Provider
default_status: unaffected
Credits: lang: en
value: Noah Stapp
Published: 2024-02-20T20:30:28.924Z
CVE-2024-25142 Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache 
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. 

Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser.

This issue affects Apache Airflow: before 2.9.2.

Users are recommended to upgrade to version 2.9.2, which fixes the issue.


Problem types: cwe_id: CWE-525
description: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Jens Scheffler
Published: 2024-06-14T08:25:35.633Z
CVE-2024-25143 
The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Liferay
product: DXP
default_status: unknown
vendor: Liferay
product: Portal
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-02-07T14:45:04.168Z
CVE-2024-25144 
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
version: 3.1
Published: 2024-02-08T03:25:31.037Z
CVE-2024-25145 
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-02-07T14:57:33.054Z
CVE-2024-25146 
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.
Problem types: cwe_id: CWE-204
description: CWE-204 Observable Response Discrepancy
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-02-08T03:36:07.512Z
CVE-2024-25147 
Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Liferay
product: Portal
default_status: unknown
vendor: Liferay
product: DXP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-02-21T01:16:21.256Z