CVE-2025-4599

Description

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Reserved 2025-05-12 | Published 2025-08-04 | Updated 2025-08-04 | Assigner Liferay

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

7.4.0
affected

Default status
unaffected

7.4.13-u61
affected

2024.Q1.1
affected

2024.Q2.0
affected

2024.Q3.0
affected

2024.Q4.0
affected

Credits

Gareth Catterall, AnchorSec security team reporter

References

liferay.dev/.../-/asset_publisher/jekt/content/CVE-2025-4599

cve.org (CVE-2025-4599)

nvd.nist.gov (CVE-2025-4599)

Download JSON