A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp

Liferay Portal versions 7.4.x prior to 7.4.3.133 and DXP versions prior to 2024.Q1.16 or 2025.Q1.x prior to 2025.Q1.5 or 2025.Q2.x prior to 2025.Q2.0 are affected by a Cross-Site Scripting allowing an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and
    Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13,
    2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-
    authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-
    INF/resources/blogs/entry_cover_image_caption.jsp (CVE-2025-4576)

The version of Liferay Portal installed on the remote host is 7.4.x <= 7.4.3.132. It is, therefore, affected by multiple vulnerabilities:

  - A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal allows an remote non-authenticated attacker   to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp   (CVE-2025-4576)

  - The vulnerable code can bypass the Captcha check in Liferay Portal and then attackers can run scripts in the Gogo shell.
  (CVE-2025-4604)

  - Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through     2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and     7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the     calendar portlet, allowing an attacker to send phishing emails to any other user in the same     organization. (CVE-2025-43739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114945	Liferay Portal 7.4.x < 7.4.3.133 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
432646	SCA: security update for com.liferay:com.liferay.blogs.web (GHSA-6qcg-28jh-hm7r)	Tenable Cloud Security	SCA Checks	medium
432646	SCA: security update for com.liferay:com.liferay.blogs.web (GHSA-6qcg-28jh-hm7r)	Tenable Self-Hosted Container Security	SCA Checks	medium
245205	Liferay Portal 7.4.0.x <= 7.4.3.132 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-4576

medium

Tenable Plugins

medium

medium

medium

medium