CVE-2024-8980 | ByteOS Network

Vulnerability Details :

CVE-2024-8980

Assigner-Liferay

Assigner Org ID-8b54e794-c6f0-462e-9faa-c1001a673ac3

Published At-22 Oct, 2024 | 14:43

Updated At-22 Oct, 2024 | 15:08

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:Liferay

Assigner Org ID:8b54e794-c6f0-462e-9faa-c1001a673ac3

Published At:22 Oct, 2024 | 14:43

Updated At:22 Oct, 2024 | 15:08

▼CVE Numbering Authority (CNA)

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.

Affected Products

Vendor

Product

Default Status

unaffected

Versions

Affected

From 7.0.0 through 7.4.3.101 (maven)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 6.2.0 through portal-173 (maven)
From 7.0.10 through de-102 (maven)
From 7.1.10 through dxp-28 (maven)
From 7.2.10 through dxp-20 (maven)
From 7.3.10 through 7.3.10-u35 (maven)
From 7.4.13 through 7.4.13-u92 (maven)
From 2023.Q3.1 through 2023.Q3.4 (maven)

Problem Types

Type	CWE ID	Description
CWE	CWE-352	CWE-352 Cross-Site Request Forgery (CSRF)

Type: CWE

CWE ID: CWE-352

Description: CWE-352 Cross-Site Request Forgery (CSRF)

Metrics

Version	Base score	Base severity	Vector
3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Version: 3.1

Base score: 9.6

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Hyperlink	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980	N/A

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Vendor

Product

CPEs

cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 7.4.0 through 7.4.3.101 (maven)
From 7.3.0 through 7.3.7 (maven)
From 7.2.0 through 7.2.1 (maven)
From 7.1.0 through 7.1.3 (maven)
From 7.0.0 through 2023.q3.4 (maven)

Vendor

Product

CPEs

cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 2023.q3.1 through 2023.q3.4 (maven)
7.4
From 7.3ga through update35 (maven)
7.2
7.1
7.0
6.2

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@liferay.com

Published At:22 Oct, 2024 | 15:15

Updated At:10 Dec, 2024 | 21:07

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 9.6

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE Matches

>>digital_experience_platform>>Versions from 6.2(inclusive) to 7.2(inclusive)

cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*

>>digital_experience_platform>>Versions from 2023.q3.1(inclusive) to 2023.q3.5(exclusive)

cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*

>>digital_experience_platform>>7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*

>>digital_experience_platform>>7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-352	Secondary	security@liferay.com
CWE-352	Primary	nvd@nist.gov

CWE ID: CWE-352

Type: Secondary

Source: security@liferay.com

CWE ID: CWE-352

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980	security@liferay.com	Vendor Advisory

Hyperlink: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980

Source: security@liferay.com

Resource:

Vendor Advisory

Similar CVEs

455Records found

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-2||LOW

EPSS-0.03% / 9.30%

||

7 Day CHG~0.00%

Published-23 Oct, 2025 | 18:47

Updated-12 Dec, 2025 | 20:40

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.03% / 9.38%

||

7 Day CHG-0.00%

Published-31 Oct, 2025 | 17:32

Updated-10 Nov, 2025 | 17:11

Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.03% / 8.57%

||

7 Day CHG-0.00%

Published-31 Oct, 2025 | 18:12

Updated-10 Nov, 2025 | 17:04

Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or (3) Last Name text field.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.15% / 34.83%

||

7 Day CHG~0.00%

Published-21 Feb, 2024 | 02:39

Updated-22 Apr, 2025 | 16:25

Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal portal dxp

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.15% / 35.69%

||

7 Day CHG~0.00%

Published-07 Feb, 2024 | 14:57

Updated-13 May, 2025 | 18:17

Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.

Vendor-Liferay Inc.

Product-liferay_portal dxp digital_experience_platform DXP Portal portal dxp

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.15% / 35.20%

||

7 Day CHG~0.00%

Published-04 Aug, 2021 | 13:21

Updated-04 Aug, 2024 | 00:40

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-11.80% / 93.87%

||

7 Day CHG+2.75%

Published-08 Aug, 2025 | 15:42

Updated-15 Dec, 2025 | 15:54

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-2||LOW

EPSS-0.17% / 37.65%

||

7 Day CHG~0.00%

Published-04 Aug, 2025 | 21:18

Updated-15 Dec, 2025 | 16:25

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.14% / 34.00%

||

7 Day CHG~0.00%

Published-04 Aug, 2025 | 22:08

Updated-15 Dec, 2025 | 16:20

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.04% / 11.49%

||

7 Day CHG~0.00%

Published-10 Sep, 2025 | 20:03

Updated-16 Dec, 2025 | 14:45

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.04% / 14.06%

||

7 Day CHG~0.00%

Published-09 Sep, 2025 | 01:21

Updated-12 Dec, 2025 | 20:28

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.04% / 14.02%

||

7 Day CHG~0.00%

Published-15 Sep, 2025 | 19:07

Updated-16 Dec, 2025 | 16:12

Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.04% / 14.16%

||

7 Day CHG+0.01%

Published-24 Sep, 2025 | 00:56

Updated-15 Dec, 2025 | 18:19

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and executed within the user's browser.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.03% / 10.19%

||

7 Day CHG~0.00%

Published-29 Sep, 2025 | 22:30

Updated-11 Dec, 2025 | 21:48

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.03% / 9.38%

||

7 Day CHG~0.00%

Published-08 Oct, 2025 | 13:11

Updated-12 Dec, 2025 | 20:44

Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-25.06% / 96.30%

||

7 Day CHG~0.00%

Published-06 May, 2025 | 18:01

Updated-16 Dec, 2025 | 16:46

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.21% / 43.26%

||

7 Day CHG+0.14%

Published-12 Aug, 2025 | 12:19

Updated-16 Dec, 2025 | 16:53

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.03% / 10.19%

||

7 Day CHG~0.00%

Published-29 Sep, 2025 | 21:38

Updated-11 Dec, 2025 | 22:04

Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Calendar's “Name” text field

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.15% / 34.77%

||

7 Day CHG-0.10%

Published-03 Aug, 2021 | 20:58

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.08%

||

7 Day CHG~0.00%

Published-23 Aug, 2025 | 01:03

Updated-12 Dec, 2025 | 20:10

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.04% / 14.16%

||

7 Day CHG~0.00%

Published-16 Sep, 2025 | 22:23

Updated-07 Nov, 2025 | 19:15

Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.26% / 49.54%

||

7 Day CHG~0.00%

Published-04 Aug, 2021 | 13:15

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.04% / 14.02%

||

7 Day CHG~0.00%

Published-15 Sep, 2025 | 18:08

Updated-16 Dec, 2025 | 15:15

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a "Rich Text" type field to (1) a web content structure, (2) a Documents and Media Document Type , or (3) custom assets that uses the Data Engine's module Rich Text field.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.8||MEDIUM

EPSS-0.04% / 14.02%

||

7 Day CHG~0.00%

Published-15 Sep, 2025 | 21:58

Updated-12 Dec, 2025 | 15:26

Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.04% / 12.81%

||

7 Day CHG~0.00%

Published-23 Aug, 2025 | 02:49

Updated-12 Dec, 2025 | 20:10

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.03% / 10.28%

||

7 Day CHG~0.00%

Published-29 Sep, 2025 | 21:19

Updated-11 Dec, 2025 | 22:05

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.05% / 17.31%

||

7 Day CHG~0.00%

Published-23 Aug, 2025 | 03:41

Updated-12 Dec, 2025 | 20:09

Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.08%

||

7 Day CHG~0.00%

Published-20 Aug, 2025 | 11:35

Updated-16 Dec, 2025 | 15:00

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.06% / 18.34%

||

7 Day CHG~0.00%

Published-12 Sep, 2025 | 19:55

Updated-16 Dec, 2025 | 15:20

Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter. Open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter. Open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.04% / 12.81%

||

7 Day CHG~0.00%

Published-10 Sep, 2025 | 16:19

Updated-16 Dec, 2025 | 15:07

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.08%

||

7 Day CHG~0.00%

Published-22 Aug, 2025 | 20:25

Updated-12 Dec, 2025 | 20:10

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.05% / 16.08%

||

7 Day CHG~0.00%

Published-23 Aug, 2025 | 04:32

Updated-12 Dec, 2025 | 20:08

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.03% / 7.63%

||

7 Day CHG~0.00%

Published-21 Oct, 2025 | 18:12

Updated-12 Dec, 2025 | 20:39

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.04% / 12.32%

||

7 Day CHG~0.00%

Published-27 Oct, 2025 | 18:54

Updated-12 Dec, 2025 | 20:42

Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-4.6||MEDIUM

EPSS-0.18% / 38.80%

||

7 Day CHG~0.00%

Published-17 Dec, 2024 | 20:24

Updated-28 Mar, 2025 | 20:15

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.28% / 51.53%

||

7 Day CHG~0.00%

Published-17 May, 2021 | 10:22

Updated-03 Aug, 2024 | 21:55

Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 65.23%

||

7 Day CHG~0.00%

Published-17 May, 2021 | 10:27

Updated-03 Aug, 2024 | 21:55

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Vendor-n/a Liferay Inc.

Product-dxp liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.18% / 40.11%

||

7 Day CHG~0.00%

Published-19 Mar, 2025 | 19:00

Updated-16 Dec, 2025 | 18:43

Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter

Vendor-Liferay Inc.

Product-liferay_portal digital_experience_platform Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.28% / 51.53%

||

7 Day CHG~0.00%

Published-09 Jun, 2021 | 18:46

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

Vendor-n/a Liferay Inc.

Product-dxp digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 65.23%

||

7 Day CHG~0.00%

Published-17 May, 2021 | 11:08

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 65.23%

||

7 Day CHG~0.00%

Published-16 May, 2021 | 14:58

Updated-03 Aug, 2024 | 21:55

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

Vendor-n/a Liferay Inc.

Product-liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 65.23%

||

7 Day CHG~0.00%

Published-17 May, 2021 | 10:55

Updated-13 May, 2025 | 18:17

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.

Vendor-n/a Liferay Inc.

Product-liferay_portal dxp digital_experience_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.32% / 55.79%

||

7 Day CHG~0.00%

Published-20 Feb, 2024 | 06:03

Updated-28 Jan, 2025 | 21:34

Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.19% / 40.89%

||

7 Day CHG~0.00%

Published-20 Feb, 2024 | 06:29

Updated-28 Jan, 2025 | 21:34

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform DXP digital_experience_platform

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.19% / 40.98%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 07:56

Updated-13 Sep, 2024 | 16:32

Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.21% / 43.29%

||

7 Day CHG~0.00%

Published-17 Oct, 2023 | 12:08

Updated-12 Jun, 2025 | 15:09

Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.44% / 63.63%

||

7 Day CHG~0.00%

Published-21 Feb, 2024 | 02:21

Updated-28 Jan, 2025 | 02:54

Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-9.6||CRITICAL

EPSS-0.44% / 63.63%

||

7 Day CHG~0.00%

Published-21 Feb, 2024 | 02:47

Updated-28 Jan, 2025 | 02:47

Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal DXP Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.40% / 61.29%

||

7 Day CHG~0.00%

Published-15 Jun, 2023 | 03:59

Updated-22 Oct, 2024 | 15:41

Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Vendor-Liferay Inc.

Product-dxp liferay_portal DXP Portal

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

Matching Score-8

Assigner-Liferay, Inc.

Matching Score-8

Assigner-Liferay, Inc.

CVSS Score-5.1||MEDIUM

EPSS-0.04% / 13.59%

||

7 Day CHG-0.00%

Published-30 Oct, 2025 | 17:37

Updated-11 Nov, 2025 | 01:58

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.

Vendor-Liferay Inc.

Product-digital_experience_platform liferay_portal Portal DXP

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')