CVE-2025-2536: XSS

Q: What is the severity of CVE-2025-2536?

CVE-2025-2536 is classified as a high-severity cross-site scripting (XSS) vulnerability.

Q: How do I fix CVE-2025-2536?

To fix CVE-2025-2536, upgrade Liferay Portal to version 7.4.3.129 or later, and Liferay DXP to the latest available version.

Q: Which versions are affected by CVE-2025-2536?

CVE-2025-2536 affects Liferay Portal versions 7.4.3.82 through 7.4.3.128 and Liferay DXP versions from 2023.Q3.1 to 2024.Q2.13.

Q: What type of vulnerability is CVE-2025-2536?

CVE-2025-2536 is a cross-site scripting (XSS) vulnerability that can allow attackers to inject malicious scripts.

Q: Can CVE-2025-2536 be exploited remotely?

Yes, CVE-2025-2536 can be exploited remotely by an attacker to execute arbitrary scripts in the context of the user’s session.

Published Mar 19, 2025

Updated

Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/liferay/index.js allows remote attackers to inject arbitrary web script or HTML via toastData parameter

Affected Software

25 affected componentsFixes available

Liferay portal>=7.4.3.82<=7.4.3.128, >=7.4 update 82<7.4 update 92

Liferay DXP>=2024.Q2.0<2024.Q2.13, >=2024.Q1.1<2024.Q1.12, >=2023.Q4.0<2023.Q4.10, >=2023.Q3.1<2023.Q3.10

maven/com.liferay.portal:release.dxp.bom>=2024.Q3.0<2024.Q3.1

2024.Q3.1

maven/com.liferay.portal:release.dxp.bom>=2023.Q3.1<=2023.Q3.10

2024.Q4.0

maven/com.liferay.portal:release.dxp.bom>=2023.Q4.0<=2023.Q4.10

2024.Q4.0

maven/com.liferay.portal:release.dxp.bom>=2024.Q1.1<2024.Q1.13

2024.Q1.13

maven/com.liferay.portal:release.portal.bom>=7.4.3.82<7.4.3.129

7.4.3.129

maven/com.liferay.portal:release.dxp.bom>=2024.Q2.0<=2024.Q2.11

Liferay Digital Experience Platform>=2023.Q3.1<=2023.Q3.10

Liferay Digital Experience Platform>=2023.q4.0<=2023.q4.10

Liferay Digital Experience Platform>=2024.q1.1<=2024.q1.12

Liferay Digital Experience Platform>=2024.q2.0<=2024.q2.13

Liferay Digital Experience Platform=7.4-update82

Liferay Digital Experience Platform=7.4-update83

Liferay Digital Experience Platform=7.4-update84

Liferay Digital Experience Platform=7.4-update85

Liferay Digital Experience Platform=7.4-update86

Liferay Digital Experience Platform=7.4-update87

Liferay Digital Experience Platform=7.4-update88

Liferay Digital Experience Platform=7.4-update89

Liferay Digital Experience Platform=7.4-update90

Liferay Digital Experience Platform=7.4-update91

Liferay Digital Experience Platform=7.4-update92

Liferay Digital Experience Platform=2024.q3.0

Liferay Liferay Portal>=7.4.3.82<=7.4.3.128

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 2024.Q3.1
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 2024.Q4.0
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 2024.Q1.13
Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.3.129
Upgrade
Upgrade Liferay Portal Frontend JS module layout-taglib/__liferay__/index.js to a version that resolves this vulnerability.
Fixed in 7.4.3.82 through 7.4.3.128
Upgrade
Upgrade Liferay DXP to a version that resolves this vulnerability.
Fixed in 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's layout-taglib/__liferay__/index.js

Event History

Mar 19, 2025

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

Affected Software

Advisory Published

via GitHub·09:30 PM

May 20, 58462

Event

via NVD·10:45 PM

Frequently Asked Questions

What is the severity of CVE-2025-2536?

CVE-2025-2536 is classified as a high-severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2025-2536?

To fix CVE-2025-2536, upgrade Liferay Portal to version 7.4.3.129 or later, and Liferay DXP to the latest available version.

Which versions are affected by CVE-2025-2536?

CVE-2025-2536 affects Liferay Portal versions 7.4.3.82 through 7.4.3.128 and Liferay DXP versions from 2023.Q3.1 to 2024.Q2.13.

What type of vulnerability is CVE-2025-2536?

CVE-2025-2536 is a cross-site scripting (XSS) vulnerability that can allow attackers to inject malicious scripts.

Can CVE-2025-2536 be exploited remotely?

Yes, CVE-2025-2536 can be exploited remotely by an attacker to execute arbitrary scripts in the context of the user’s session.

CVE-2025-2536: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2025-2536?

How do I fix CVE-2025-2536?

Which versions are affected by CVE-2025-2536?

What type of vulnerability is CVE-2025-2536?

Can CVE-2025-2536 be exploited remotely?

Company

Resources

Contact