There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP
    2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through
    2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows
    an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious
    payload is stored and executed through Process Builder's Configuration tab without proper escaping.
    (CVE-2025-43776)

易受攻擊的程式碼可繞過 Liferay Portal 和 Liferay DXP 中的 Captcha 檢查然後攻擊者可在 Gogo 殼層中執行指令碼。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

易受攻击的代码可绕过 Liferay Portal 和 Liferay DXP 中的验证码检查然后攻击者便可在 Gogo shell 中运行脚本。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

この脆弱なコードが Liferay Portal および Liferay DXP の Captcha チェックをバイパスし、攻撃者が Gogo シェルでスクリプトを実行する可能性があります。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Liferay Portal installed on the remote host is 7.4.x <= 7.4.3.132. It is, therefore, affected by multiple vulnerabilities:

  - A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal allows an remote non-authenticated attacker   to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp   (CVE-2025-4576)

  - The vulnerable code can bypass the Captcha check in Liferay Portal and then attackers can run scripts in the Gogo shell.
  (CVE-2025-4604)

  - Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through     2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and     7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the     calendar portlet, allowing an attacker to send phishing emails to any other user in the same     organization. (CVE-2025-43739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
435269	SCA: security update for com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.workflow.web (GHSA-rcc7-jx7p-hrv4)	Tenable Cloud Security	SCA Checks	9/11/2025	7/2/2026	medium
435269	SCA: security update for com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.portal.workflow.web (GHSA-rcc7-jx7p-hrv4)	Tenable Self-Hosted Container Security	SCA Checks	9/11/2025	7/2/2026	medium
245205	Liferay Portal 7.4.0.x <= 7.4.3.132 CAPTCHA 繞過	Nessus	CGI abuses	8/7/2025	1/21/2026	medium
245205	Liferay Portal 7.4.0.x <= 7.4.3.132 CAPTCHA 绕过	Nessus	CGI abuses	8/7/2025	1/21/2026	medium
245205	Liferay Portal 7.4.0.x <= 7.4.3.132 CAPTCHA バイパス	Nessus	CGI abuses	8/7/2025	1/21/2026	medium
245205	Liferay Portal 7.4.0.x <= 7.4.3.132 Multiple Vulnerabilities	Nessus	CGI abuses	8/7/2025	1/21/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium