Liferay DXP Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-4604 - Vulnerability Database

Liferay DXP

Liferay DXP Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2025-4604

Medium

Reference: CVE-2025-4604

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-4604

Title: Liferay DXP Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132 and Liferay DXP 2024.Q1.1 through 2024.Q1.19 2024.Q2.0 through 2024.Q2.13 2024.Q3.0 through 2024.Q3.13 2024.Q4.0 through 2024.Q4.7 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell