CVE-2024-11993: Liferay Digital Experience Platform

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Affected products

• Liferay Digital Experience Platform: from 7.1, before 7.4 (fixed in 7.4); version 7.4 only
• Liferay Liferay Portal: from 7.1.0, before 7.4.3.39 (fixed in 7.4.3.39)

Published 2024-12-17. Last modified 2026-06-17.