CVE-2025-4388 MEDIUM

CVE-2025-4388

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published May 6, 2025
Last update May 6, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

Key dates

02Disclosure timeline

May 6, 2025 CVE published
May 6, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-12156 AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting CVE-2023-3834 Bug Finder EX-RATE Ticket create cross site scripting CVE-2024-29127 WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2022-4214 Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip CVE-2025-22664 WordPress Survey Maker Plugin <= 5.1.3.5 - Cross Site Scripting (XSS) vulnerability