GHSA-6qcg-28jh-hm7r

Liferay Portal Reflected XSS in blogs-web

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-4576

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.blogs.web	< 6.0.139	6.0.139

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the `modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-4576 advisory
https://github.com/liferay/liferay-portal/commit/afd9e7751fff6f573699ef1169da279957f72428 web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18194 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4576 web