CVE-2025-4388: XSS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4388?
CVE-2025-4388 has been classified as a high-severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-4388?
To mitigate CVE-2025-4388, update Liferay Portal to version 7.4.3.132 or later and Liferay DXP to versions beyond the affected ones listed in the vulnerability report.
Which Liferay versions are affected by CVE-2025-4388?
CVE-2025-4388 affects Liferay Portal versions 7.4.0 through 7.4.3.131 and multiple versions of Liferay DXP 2024 from Q1 to Q4.
Is CVE-2025-4388 exploitable by unauthenticated users?
Yes, CVE-2025-4388 can be exploited by remote unauthenticated attackers using reflected XSS techniques.
What potential impact does CVE-2025-4388 have on users?
CVE-2025-4388 may allow attackers to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or session hijacking.