CVE-2024-25151: 
Java vulnerability analysis and mitigation

CVE-2024-25151 is a security vulnerability discovered in the Calendar module of Liferay Portal (versions 7.2.0 through 7.4.2) and Liferay DXP (7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions). The vulnerability was disclosed on February 20, 2024, and involves improper escaping of user-supplied data in the default notification email template (Liferay Advisory).

The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 5.4 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The technical issue stems from the failure to properly escape user-supplied data in the default notification email template of the Calendar module (NVD).

The vulnerability allows remote authenticated users to inject arbitrary web script or HTML through two attack vectors: the title of a calendar event or the user's name. The impact can manifest as either content spoofing or cross-site scripting (XSS) attacks, with the actual effect depending on the capabilities of the receiver's mail client (Liferay Advisory).

Fixed versions have been released to address this vulnerability: Liferay Portal 7.4.3.4, Liferay DXP 7.3 service pack 3, and Liferay DXP 7.2 fix pack 15. Users are advised to upgrade to these patched versions (Liferay Advisory).