Description A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.
A reflected cross-site scripting vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, as well as in several Liferay DXP releases. This vulnerability allows remote authenticated attackers to inject JavaScript code by exploiting the '_com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition' parameter.
Liferay Portal users can update to the latest version available on the master branch. Liferay DXP users should upgrade to version 2025.Q2.3, 2025.Q1.15, or 2024.Q1.19.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 20, 2025 Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration CWE-ID CWE Name Source CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [email protected]
Affected Products Product Versions liferay digital experience platform >= 2024.Q1.1, < 2024.Q1.19
>= 2024.Q2.1, <= 2024.Q2.13
>= 2024.q3.1, <= 2024.q3.13
>= 2024.q4.0, <= 2024.q4.7
>= 2025.Q1.0, < 2025.Q1.15
>= 2025.Q2.0, < 2025.Q2.3
7.4 -
7.4 update1
7.4 update10
7.4 update11
7.4 update12
7.4 update13
7.4 update14
7.4 update15
7.4 update16
7.4 update17
7.4 update18
7.4 update19
7.4 update2
7.4 update20
7.4 update21
7.4 update22
7.4 update23
7.4 update24
7.4 update25
7.4 update26
7.4 update27
7.4 update28
7.4 update29
7.4 update3
7.4 update30
7.4 update31
7.4 update32
7.4 update33
7.4 update34
7.4 update35
7.4 update36
7.4 update37
7.4 update38
7.4 update39
7.4 update4
7.4 update40
7.4 update41
7.4 update42
7.4 update43
7.4 update44
7.4 update45
7.4 update46
7.4 update47
7.4 update48
7.4 update49
7.4 update5
7.4 update50
7.4 update51
7.4 update52
7.4 update53
7.4 update54
7.4 update55
7.4 update56
7.4 update57
7.4 update58
7.4 update59
7.4 update6
7.4 update60
7.4 update61
7.4 update62
7.4 update63
7.4 update64
7.4 update65
7.4 update66
7.4 update67
7.4 update68
7.4 update69
7.4 update7
7.4 update70
7.4 update71
7.4 update72
7.4 update73
7.4 update74
7.4 update75
7.4 update76
7.4 update77
7.4 update78
7.4 update79
7.4 update8
7.4 update80
7.4 update81
7.4 update82
7.4 update83
7.4 update84
7.4 update85
7.4 update86
7.4 update87
7.4 update88
7.4 update89
7.4 update9
7.4 update90
7.4 update91
7.4 update92
Viewing 5 of 99 versions. View all CPE cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:* Remediation No remediation found in references. liferay liferay portal >= 7.4.0, <= 7.4.3.132
CPE cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Remediation No remediation found in references.
Change History 4 change records found show changes