IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-19 13:15

MODIFIED

2025-08-19 13:42

EPSS (Prob. Exploit)

0.22%

Top 88.6%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-01

> DESCRIPTION

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-22jp-w3cg-gvmm MODERATE

Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature

AFFECTED PACKAGES:

MAVEN / com.liferay.portal:release.portal.bom

>= 7.4.3.120-ga120, <= 7.4.3.132-ga23

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-22jp-w3cg-gvmm

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/08/2025 13:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui