CVE-2024-25144
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
We have discovered 486 live websites that are affected by CVE-2024-25144.
Affected Software
| Product |  Liferay |
| Category | Content Management System |
| Vulnerable Domains | 486 live websites (19% of Liferay install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 23 versions ( 40% of all versions) |
Common Weakness Enumeration
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')Details
- Published - Feb 8, 2024
- Updated - Oct 2, 2024
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2024-25144 United States | 47 websites |
 Spain | 104 websites |
 Vietnam | 48 websites |
 Italy | 45 websites |
 Iran | 38 websites |
 Brazil | 34 websites |
 Namibia | 26 websites |
 Germany | 24 websites |
 Portugal | 12 websites |
 Netherlands | 12 websites |
Website Distribution by TLD
Number of websites using CVE-2024-25144| .com | 68 websites |
| .es | 59 websites |
| .it | 34 websites |
| .org | 20 websites |
| .de | 19 websites |
| .nl | 13 websites |
| .eu | 8 websites |
| .ca | 5 websites |
| .fi | 5 websites |
| .net | 5 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2024-25144
Top websites that are affected by CVE-2024-25144. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| **********.it | United States | **,*** | |
| ****.***.it | Italy | **,*** | |
| ******.*****.***.hu |  Hungary | **,*** | |
| *******.es | Spain | **,*** | |
| **.****.**.ir | Iran | **,*** | |
| ******.es | Spain | **,*** | |
| *********.org | United States | **,*** | |
| ****.***.it | Italy | **,*** | |
| ***.com | United States | **,*** | |
| ****************.org |  France | ***,*** |
FAQ
CVE-2024-25144 is Loop with Unreachable Exit Condition ('Infinite Loop') in Liferay
A total of 486 websites have been identified as vulnerable to CVE-2024-25144, based on global website indexing conducted by WebTechSurvey.
The Liferay is affected by the CVE-2024-25144 vulnerability.
Liferay versions up to and including 7.4.3.26 are vulnerable to CVE-2024-25144.