IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-21 17:15

MODIFIED

2025-08-22 18:08

EPSS (Prob. Exploit)

0.22%

Top 88.1%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-58cq-8wm2-6m87 MODERATE

Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.layout.admin.web

< 5.0.191

Fixed in: 5.0.191

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

10 versions affected

ALIASES:

GHSA-58cq-8wm2-6m87

> HISTORIQUE DES MODIFICATIONS

Première apparition

21/08/2025 17:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui