VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 4, 2025· Updated Aug 5, 2025

CVE-2025-4599

CVE-2025-4599

Description

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Liferay/Portalllm-fuzzy2 versions
    7.4.3.61 - 7.4.3.132+ 1 more
    • (no CPE)range: 7.4.3.61 - 7.4.3.132
    • (no CPE)range: 7.4.0
  • Liferay/DXPllm-fuzzy2 versions
    2024.Q4.1 - 2024.Q4.5, 2024.Q3.1 - 2024.Q3.13, 2024.Q2.0 - 2024.Q2.13, 2024.Q1.1 - 2024.Q1.13, 7.4 update 61 - 92+ 1 more
    • (no CPE)range: 2024.Q4.1 - 2024.Q4.5, 2024.Q3.1 - 2024.Q3.13, 2024.Q2.0 - 2024.Q2.13, 2024.Q1.1 - 2024.Q1.13, 7.4 update 61 - 92
    • (no CPE)range: 7.4.13-u61

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.