CVE-2025-4388: XSS
First published: Tue May 06 2025(Updated: )
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.
Credit: security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay 7.4 GA | >=7.4.0<=7.4.3.131 | |
| Liferay 7.4 GA | >=2024.Q4.0<=2024.Q4.5>=2024.Q3.1<=2024.Q3.13>=2024.Q2.0<=2024.Q2.13>=2024.Q1.1<=2024.Q1.12 | |
| Liferay 7.4 GA | >=7.4 GA<=7.4.92 | |
| maven/com.liferay:com.liferay.marketplace.app.manager.web | <5.0.50 | 5.0.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4388?
CVE-2025-4388 has been classified as a high-severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-4388?
To mitigate CVE-2025-4388, update Liferay Portal to version 7.4.3.132 or later and Liferay DXP to versions beyond the affected ones listed in the vulnerability report.
Which Liferay versions are affected by CVE-2025-4388?
CVE-2025-4388 affects Liferay Portal versions 7.4.0 through 7.4.3.131 and multiple versions of Liferay DXP 2024 from Q1 to Q4.
Is CVE-2025-4388 exploitable by unauthenticated users?
Yes, CVE-2025-4388 can be exploited by remote unauthenticated attackers using reflected XSS techniques.
What potential impact does CVE-2025-4388 have on users?
CVE-2025-4388 may allow attackers to execute arbitrary scripts in the context of a user's session, potentially leading to data theft or session hijacking.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-p2f8-vq4r-gqg3
- alias/CVE-2025-4388
- collector/nvd-cve
- source/NVD
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-api
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/liferay
- canonical/liferay 7.4 ga
- package-manager/maven