Cross-Site Scripting Vulnerability in Liferay Portal and DXP Products
CVE-2025-2536
5.1MEDIUM
What is CVE-2025-2536?
A cross-site scripting vulnerability exists in Liferay Portal versions 7.4.3.82 through 7.4.3.128 and multiple Liferay DXP releases. This flaw enables remote attackers to execute arbitrary web scripts or HTML, potentially compromising user data and session integrity. The vulnerability arises from improper handling of the toastData parameter in the Frontend JS module's layout-taglib, specifically in the index.js file, allowing injection of malicious content.
Affected Version(s)
DXP 7.4.13-u82 <= 7.4.13-u92
DXP 2023.Q3.1 <= 2023.Q3.10
DXP 2023.Q4.0 <= 2023.Q4.10