CVE-2024-11993

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: Dec 17, 2024
Source updated: Mar 28, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Portal

Vendor: Liferay
Product: Portal
Platforms: Unknown
Default status: unaffected

Portal · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.4.0	`affected`	maven	Unavailable	7.4.3.38	None listed

DXP

Vendor: Liferay
Product: DXP
Platforms: Unknown
Default status: unaffected

DXP · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.4.13	`affected`	maven	Unavailable	7.4.13-u38	None listed