CVE-2024-25601: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability (CVE-2024-25601) was discovered in the Expando module's geolocation custom fields in Liferay Portal versions 7.2.0 through 7.4.2 and Liferay DXP versions 7.3 before service pack 3 and 7.2 before fix pack 17. The vulnerability was disclosed on February 20, 2024 (NVD).

The vulnerability allows remote authenticated users to inject arbitrary web script or HTML through a crafted payload injected into the name text field of a geolocation custom field. The vulnerability has received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST and 9.0 (CRITICAL) from Liferay Inc., with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary web scripts or HTML in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.4, Liferay DXP 7.3 service pack 3, and Liferay DXP 7.2 fix pack 17. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).