Open-source package vulnerability · Maven

CVE-2024-25610: Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)

criticalCVSS 3.1 9.0GHSA-vvpf-53qx-cxhh

In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.

Published Feb 20, 2024 · Updated Mar 25, 2026

Affected packages

com.liferay.portal:release.portal.bom

Ecosystem: Maven
Affected: < 7.4.3.13
Fixed in: 7.4.3.13
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.portal.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 7.4.0, < 7.4.13.u9
Fixed in: 7.4.13.u9
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 7.3.0, < 7.3.10.u4
Fixed in: 7.3.10.u4
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: < 7.2.10.fp19
Fixed in: 7.2.10.fp19
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:com.liferay.portal.web

Ecosystem: Maven
Affected: < 5.0.96
Fixed in: 5.0.96
Check: mvn dependency:tree -Dincludes=com.liferay.portal:com.liferay.portal.web

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries