Liferay vulnerabilities and threats

143 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.9	EPSS 0.2%	CVE-2025-43745Liferay Portal · Cross-Site Request Forgery (CSRF) Medium6.9EPSS 0.2%2025-08-19CVE Database V5CVE-2025-43745 A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote attackers to performs cross-origin request on behalf of the authenticated user via the endpoint parameter. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2025-08-19
Medium	5.1	EPSS 0.3%	CVE-2025-43737Liferay Portal · Cross-site Scripting Medium5.1EPSS 0.3%2025-08-19CVE Database V5CVE-2025-43737 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2025-08-19
Medium	5.1	EPSS 0.2%	CVE-2025-43738Liferay Portal · Cross-site Scripting Medium5.1EPSS 0.2%2025-08-19CVE Database V5CVE-2025-43738 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-19
Medium	5.3	EPSS 0.3%	CVE-2025-43739Liferay Portal · Observable Discrepancy Medium5.3EPSS 0.3%2025-08-19CVE Database V5CVE-2025-43739 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization. EPSS 0.3%Vulnerability CWE-203	CVE Database V5	2025-08-19
Medium	4.6	EPSS 0.2%	CVE-2025-43740Liferay Portal · Cross-site Scripting Medium4.6EPSS 0.2%2025-08-19CVE Database V5CVE-2025-43740 A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-19
Medium	6.9	EPSS 0.2%	CVE-2025-43731Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-18CVE Database V5CVE-2025-43731 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-18
Low	2.0	EPSS 0.5%	CVE-2025-3639Liferay Portal · Authentication Bypass Using an Alternate Path or Channel Low2.0EPSS 0.5%2025-08-18CVE Database V5CVE-2025-3639 Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. EPSS 0.5%Vulnerability CWE-288	CVE Database V5	2025-08-18
Medium	4.8	EPSS 0.2%	CVE-2025-43732Liferay Portal · Insecure Direct Object Reference Medium4.8EPSS 0.2%2025-08-18CVE Database V5CVE-2025-43732 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When an organization administrator modifies this parameter id value, they can gain unauthorized access to user lists from other organizations. EPSS 0.2%Vulnerability CWE-639	CVE Database V5	2025-08-18
Low	2.3	EPSS 0.2%	CVE-2025-43733Liferay Portal · XSS or 'Cross-site Scripting' Low2.3EPSS 0.2%2025-08-18CVE Database V5CVE-2025-43733 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-18
Medium	5.1	EPSS 0.2%	CVE-2025-43734Liferay Portal · XSS or 'Cross-site Scripting' Medium5.1EPSS 0.2%2025-08-12CVE Database V5CVE-2025-43734 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-12
Medium	6.9	EPSS 0.2%	CVE-2025-43735Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-12CVE Database V5CVE-2025-43735 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-12
Medium	6.9	EPSS 0.3%	CVE-2025-43736Liferay Portal · Unthrottled Resource Allocation Medium6.9EPSS 0.3%2025-08-12CVE Database V5CVE-2025-43736 A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower. EPSS 0.3%Vulnerability CWE-770	CVE Database V5	2025-08-12
Medium	5.1	EPSS 0.2%	CVE-2025-4655Liferay Portal · Server-Side Request Forgery (SSRF) Medium5.1EPSS 0.2%2025-08-09CVE Database V5CVE-2025-4655 SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows template editors to bypass access validations via crafted URLs. EPSS 0.2%Vulnerability CWE-918	CVE Database V5	2025-08-09
Medium	5.3	EPSS 0.4%	CVE-2025-4581Liferay Portal · Server-Side Request Forgery (SSRF) Medium5.3EPSS 0.4%2025-08-09CVE Database V5CVE-2025-4581 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation. EPSS 0.4%Vulnerability CWE-918	CVE Database V5	2025-08-09
Medium	6.9	EPSS 0.6%	CVE-2025-4576Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.6%2025-08-08CVE Database V5CVE-2025-4576 A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp EPSS 0.6%Vulnerability CWE-79	CVE Database V5	2025-08-08
Medium	6.9	EPSS 0.2%	CVE-2025-4604Liferay Portal · XSS or 'Cross-site Scripting' Medium6.9EPSS 0.2%2025-08-04CVE Database V5CVE-2025-4604 The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-04
Low	2.0	EPSS 0.2%	CVE-2025-4599Liferay Portal · XSS or 'Cross-site Scripting' Low2.0EPSS 0.2%2025-08-04CVE Database V5CVE-2025-4599 The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-08-04
High	8.7	EPSS 0.6%	CVE-2025-3526Liferay Portal · Uncontrolled Resource Consumption High8.7EPSS 0.6%2025-06-16CVE Database V5CVE-2025-3526 SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests. EPSS 0.6%Vulnerability CWE-400	CVE Database V5	2025-06-16
High	8.6	EPSS 0.7%	CVE-2025-3594Liferay Portal · Path Traversal High8.6EPSS 0.7%2025-06-16CVE Database V5CVE-2025-3594 Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter. EPSS 0.7%Vulnerability CWE-22	CVE Database V5	2025-06-16
High	8.7	EPSS 0.5%	CVE-2025-3602Liferay Portal · Uncontrolled Resource Consumption High8.7EPSS 0.5%2025-06-16CVE Database V5CVE-2025-3602 Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries. EPSS 0.5%Vulnerability CWE-400	CVE Database V5	2025-06-16

Page 7 of 8