A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202

Summary

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript through Custom Object field label. The malicious payload is stored and executed through Process Builder's Configuration tab without proper escaping.

Timeline

1. Sep 9, 2025, 2:18 PM UTCCVE published
2. Sep 9, 2025, 3:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 9, 2025, 3:04 PM UTCRecord last updated

Affected versions

• Liferay Portal

  From 7.4.0 · through 7.4.3.132

• Liferay DXP

  From 7.4.13 · through 7.4.13-u92; From 2024.Q1.1 · through 2024.Q1.19; From 2024.Q2.0 · through 2024.Q2.13; From 2024.Q3.0 · through 2024.Q3.13; From 2024.Q4.0 · through 2024.Q4.7; From 2025.Q1.0 · through 2025.Q1.16; From 2025.Q2.0 · through 2025.Q2.9

• com.liferay.portal:release.portal.bomMaven

  From 7.4.0 · through 7.4.3.132

• com.liferay.portal:release.dxp.bomMaven

  From 7.4 · through 7.4.13.u92

• com.liferay.portal:release.dxp.bomMaven

  From 2024.Q1.1 · fixed in 2024.Q1.20

• com.liferay.portal:release.dxp.bomMaven

  From 2024.Q2.0 · through 2024.Q2.13

• com.liferay.portal:release.dxp.bomMaven

  From 2024.Q3.0 · through 2024.Q3.13

• com.liferay.portal:release.dxp.bomMaven

  From 2024.Q4.0 · through 2024.Q4.7

• com.liferay.portal:release.dxp.bomMaven

  From 2025.Q1.0 · fixed in 2025.Q1.17

• com.liferay.portal:release.dxp.bomMaven

  From 2025.Q2.0 · fixed in 2025.Q2.10

• com.liferay:com.liferay.portal.workflow.webMaven

  fixed in 4.0.94

References 1