CVE-2025-2536

MEDIUM

Liferay Portal 7.4.3.82-7.4.3.128 & DXP 2023.Q3.1-2024.Q3.0 XSS via ToastData

Title source: llm

Description

Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter

References (1)

Core 1

Core References

Vendor Advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-2536

Scores

CVSS v3 6.1

EPSS 0.0019

EPSS Percentile 39.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (6)

com.liferay.portal/release.dxp.bom 2024.Q2.0Maven

com.liferay.portal/release.portal.bom 7.4.3.82 - 7.4.3.129Maven

liferay/digital_experience_platform 7.4 update82 (11 CPE variants)

liferay/digital_experience_platform 2024.q3.0

liferay/digital_experience_platform 2023.Q3.1 - 2023.Q3.10

liferay/liferay_portal 7.4.3.82 - 7.4.3.128

Published Mar 19, 2025

Tracked Since Feb 18, 2026