Reflected Cross-Site Scripting Vulnerability in Liferay Portal and DXP
CVE-2025-4576

6.9MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
8 August 2025

What is CVE-2025-4576?

A reflected cross-site scripting vulnerability exists in Liferay Portal and DXP that enables remote attackers to inject malicious JavaScript into web applications. This flaw affects various versions of Liferay Portal and DXP, allowing unauthenticated users to manipulate specific JSP resources, potentially compromising the integrity and confidentiality of the system. It is crucial for organizations using affected versions to implement patches and safeguard against potential exploitation.

Affected Version(s)

DXP 7.4.13 <= 7.4.13-u92

DXP 2024.Q1.1 <= 2024.Q1.15

DXP 2024.Q2.0 <= 2024.Q2.13

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shubham Shah - CTO @ Assetnote
Adam Kues - Security Researcher @ Assetnote
.
CVE-2025-4576 : Reflected Cross-Site Scripting Vulnerability in Liferay Portal and DXP