Vulnerability · Published Apr 17, 2025 · Assigned by Liferay
CVE-2025-3760
Medium 4.8
In plain English
A medium-severity cross-site scripting in DXP from Liferay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | 2024.Q1.13 | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | 2024.Q3.10 | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | 2025.Q1.0 | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.dxp.bom | no fix listed | GHSA-qhp6-vp7c-g7xp |
| Maven | com.liferay.portal:release.portal.bom | 7.4.3.132 | GHSA-qhp6-vp7c-g7xp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Portal | 7.2.0 – through 7.4.3.129 |
| Liferay | DXP | 7.2.10 – through dxp-207.3.10 – through 7.3.10-u367.4.13 – through 7.4.13-u922023.Q3.1 – through 2023.Q3.102023.Q4.0 – through 2023.Q4.102024.Q1.1 – through 2024.Q1.122024.Q2.0 – through 2024.Q2.132024.Q3.1 – through 2024.Q3.9 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N