Liferay Portal and Liferay DXP Reflected Cross-Site Scripting Vulnerability in Dynamic Data Mapping Portlet

A reflected cross-site scripting vulnerability has been identified in Liferay Portal versions 7.4.0 to 7.4.3.132, as well as in several Liferay DXP 2024 and 2025 releases. This vulnerability allows remote authenticated attackers to inject JavaScript into the application. The issue arises in the Dynamic Data Mapping portlet, specifically through the portletNamespace and namespace parameters.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious JavaScript that is executed in the context of the user's browser.

Remediation

Users can upgrade to Liferay Portal's master branch or to Liferay DXP versions 2025.Q2.3, 2025.Q1.11, or 2024.Q1.19 to address this vulnerability.