Liferay Portal and Liferay DXP Stored DOM-Based Cross-Site Scripting Vulnerability

A stored DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, as well as in several Liferay DXP releases. The vulnerability resides in the Asset Publisher configuration UI within the Source.js module. It allows attackers to inject arbitrary JavaScript through DDM structure field labels, which are then inserted into the DOM using innerHTML without proper encoding.

Impact

Exploitation of this vulnerability allows for stored DOM-based Cross-Site Scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Liferay Portal's master branch or Liferay DXP 2025.Q2.6 or 2025.Q1.16 to address this vulnerability.