Liferay Portal
Moderate fix1 remedy
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*
Moderate fix1 remedy
- >= 7.4.0, <= 7.4.3.132
Liferay Portal and Liferay DXP Reflected Cross-Site Scripting Vulnerability
Vulnerability
Patched
A reflected cross-site scripting vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, as well as in several Liferay DXP releases. This vulnerability allows remote, non-authenticated attackers to inject JavaScript into the google_gadget component.
Impact
Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious JavaScript that is executed in the context of the user's browser.
Remediation
Users of Liferay Portal can upgrade to the latest version available on the master branch. Liferay DXP users should upgrade to version 2025.Q3.3, 2025.Q1.0 through 2025.Q1.18, or 2024.Q1.1 through 2024.Q1.21.
Added: Oct 21, 2025, 7:23 PM
Updated: Oct 21, 2025, 7:33 PM
Vulnerability Rating
Custom Algorithm
spread
3.1impact
1.7exploitability
6.4remediation
7.7relevance
0.8threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.