PT-2025-19958 · Liferay · Liferay Portal+1

Adam Kues + 1 · Publicado 2025-05-06 · Atualizado 2026-03-09 · CVE-2025-4388

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q4.5

Description A reflected cross-site scripting (XSS) issue exists in Liferay Portal and DXP. A remote, unauthenticated attacker can inject JavaScript code into the /modules/apps/marketplace/marketplace-app-manager-web component. The attacker can exploit this by crafting a malicious URL containing the injected script. When a user clicks on this link, the browser executes the script, potentially allowing the attacker to gain access to the user's session and data. The exploit involves sending a crafted request to the /o/marketplace-app-manager-web/icon.jsp endpoint with a malicious iconURL parameter. The vulnerable parameter is iconURL.

Recommendations Liferay Portal versions 7.4.0 through 7.4.3.131: Update to a newer version. Liferay DXP versions 2024.Q1.1 through 2024.Q4.5: Update to a newer version.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-4388

GHSA-P2F8-VQ4R-GQG3

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 26

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/0c3ab8936429a1bc48d915fdd801580de592fd9e · Nota
• https://twitter.com/h4x0r_fr34k/status/1965701237267185737 · Publicação no Twitter
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4388 · Aviso do Fabricante
• https://twitter.com/UndercodeUpdate/status/1976711669209583739 · Publicação no Twitter
• https://twitter.com/bbwriteups/status/1953885168546046124 · Publicação no Twitter
• https://twitter.com/vuln_tracker/status/2019641153835176057 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-p2f8-vq4r-gqg3 · Aviso do Fabricante
• https://twitter.com/cybercronai/status/1920135427320668662 · Publicação no Twitter
• https://twitter.com/BugTrackr/status/1955394239715754020 · Publicação no Twitter
• https://t.me/CSIRT_italia/3236 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-4388 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1919883728450412869 · Publicação no Twitter
• https://twitter.com/A0xTrojan/status/1975964758810689785 · Publicação no Twitter
• https://twitter.com/pdnuclei_bot/status/1922607833679609953 · Publicação no Twitter