CVE-2025-3760

Description

A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.

Reserved 2025-04-17 | Published 2025-04-17 | Updated 2025-04-17 | Assigner Liferay

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

7.0.0
affected

Default status
unaffected

7.2.10
affected

7.3.10
affected

7.4.13
affected

2023.Q3.1
affected

2023.Q4.0
affected

2024.Q1.1
affected

2024.Q2.0
affected

2024.Q3.1
affected

2024.Q4.0
affected

Credits

Lucas Machado from Devoteam Cyber Trust reporter

milCERT AT reporter

References

liferay.dev/.../-/asset_publisher/jekt/content/CVE-2025-3760

cve.org (CVE-2025-3760)

nvd.nist.gov (CVE-2025-3760)

Download JSON