Description (CNA)
<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Liferay / Portal | affected 7.4.3.132 |
| Liferay / DXP | affected 2024.Q1.13 through 2024.Q1.19; affected 2025.Q1.0 through 2025.Q1.15; affected 2025.Q2.0 through 2025.Q2.2 |
CWE
CWE-79
References
ADP enrichment
No English description supplied.
No references supplied.