PT-2025-16960 · Liferay · Liferay Portal+1

Lucas Machado + 1 · Published 2025-04-17 · Updated 2025-04-29 · CVE-2025-3760

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.3.129 Liferay DXP versions 2024.Q4.1 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.9 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2023.Q4.0 through 2023.Q4.10 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 36 Liferay Portal versions 7.2 GA through fix pack 20

Description A stored cross-site scripting (XSS) issue exists with radio button type custom fields, allowing remote authenticated attackers to inject malicious JavaScript into a page.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.3.129, update to a version that includes the fix for this issue. For Liferay DXP versions 2024.Q4.1 through 2024.Q4.7, update to a version that includes the fix for this issue. For Liferay DXP versions 2024.Q3.1 through 2024.Q3.9, update to a version that includes the fix for this issue. For Liferay DXP versions 2024.Q2.0 through 2024.Q2.13, update to a version that includes the fix for this issue. For Liferay DXP versions 2024.Q1.1 through 2024.Q1.12, update to a version that includes the fix for this issue. For Liferay DXP versions 2023.Q4.0 through 2023.Q4.10, update to a version that includes the fix for this issue. For Liferay DXP versions 2023.Q3.1 through 2023.Q3.10, update to a version that includes the fix for this issue. For Liferay Portal versions 7.4 GA through update 92, apply update 93 or later. For Liferay Portal versions 7.3 GA through update 36, apply update 37 or later. For Liferay Portal versions 7.2 GA through fix pack 20, apply fix pack 21 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-3760

GHSA-QHP6-VP7C-G7XP

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhp6-vp7c-g7xp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3760 · Security Note
• https://twitter.com/CVEnew/status/1913455491549692147 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1912864187807649990 · Twitter Post
• https://t.me/cvetracker/21855 · Telegram Post
• https://twitter.com/0x1ucxs/status/1917294330085269841 · Twitter Post
• https://t.me/cvedetector/23228 · Telegram Post