Log in Start free

Vulnerability · Published Aug 4, 2025 · Assigned by Liferay

CVE-2025-4599

Low 2.0

In plain English

A low-severity cross-site scripting in DXP from Liferay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Affected products (as reported)

VendorProductVersions
Liferay Portal 7.4.0 – through 7.4.3.132
Liferay DXP 7.4.13-u61 – through 7.4.13-u922024.Q1.1 – through 2024.Q1.132024.Q2.0 – through 2024.Q2.132024.Q3.0 – through 2024.Q3.132024.Q4.0 – through 2024.Q4.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References