CVE-2025-4599

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-4599
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4599.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-4599
Published
2025-08-04T22:15:27Z
Modified
2026-09-05T08:10:17Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "2024.q1.1"
                },
                {
                    "last_affected":  "2024.q1.13"
                },
                {
                    "introduced":  "2024.q2.0"
                },
                {
                    "last_affected":  "2024.q2.13"
                },
                {
                    "introduced":  "2024.q3.1"
                },
                {
                    "last_affected":  "2024.q3.13"
                },
                {
                    "introduced":  "2024.q4.1"
                },
                {
                    "last_affected":  "2024.q4.5"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "liferay:digital_experience_platform"
        },
        {
            "cpes":  [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "7.4"
                },
                {
                    "last_affected":  "7.4"
                },
                {
                    "introduced":  "7.4-update61"
                },
                {
                    "last_affected":  "7.4-update61"
                },
                {
                    "introduced":  "7.4-update62"
                },
                {
                    "last_affected":  "7.4-update62"
                },
                {
                    "introduced":  "7.4-update63"
                },
                {
                    "last_affected":  "7.4-update63"
                },
                {
                    "introduced":  "7.4-update64"
                },
                {
                    "last_affected":  "7.4-update64"
                },
                {
                    "introduced":  "7.4-update65"
                },
                {
                    "last_affected":  "7.4-update65"
                },
                {
                    "introduced":  "7.4-update66"
                },
                {
                    "last_affected":  "7.4-update66"
                },
                {
                    "introduced":  "7.4-update67"
                },
                {
                    "last_affected":  "7.4-update67"
                },
                {
                    "introduced":  "7.4-update68"
                },
                {
                    "last_affected":  "7.4-update68"
                },
                {
                    "introduced":  "7.4-update69"
                },
                {
                    "last_affected":  "7.4-update69"
                },
                {
                    "introduced":  "7.4-update70"
                },
                {
                    "last_affected":  "7.4-update70"
                },
                {
                    "introduced":  "7.4-update71"
                },
                {
                    "last_affected":  "7.4-update71"
                },
                {
                    "introduced":  "7.4-update72"
                },
                {
                    "last_affected":  "7.4-update72"
                },
                {
                    "introduced":  "7.4-update73"
                },
                {
                    "last_affected":  "7.4-update73"
                },
                {
                    "introduced":  "7.4-update74"
                },
                {
                    "last_affected":  "7.4-update74"
                },
                {
                    "introduced":  "7.4-update75"
                },
                {
                    "last_affected":  "7.4-update75"
                },
                {
                    "introduced":  "7.4-update76"
                },
                {
                    "last_affected":  "7.4-update76"
                },
                {
                    "introduced":  "7.4-update77"
                },
                {
                    "last_affected":  "7.4-update77"
                },
                {
                    "introduced":  "7.4-update78"
                },
                {
                    "last_affected":  "7.4-update78"
                },
                {
                    "introduced":  "7.4-update79"
                },
                {
                    "last_affected":  "7.4-update79"
                },
                {
                    "introduced":  "7.4-update80"
                },
                {
                    "last_affected":  "7.4-update80"
                },
                {
                    "introduced":  "7.4-update81"
                },
                {
                    "last_affected":  "7.4-update81"
                },
                {
                    "introduced":  "7.4-update82"
                },
                {
                    "last_affected":  "7.4-update82"
                },
                {
                    "introduced":  "7.4-update83"
                },
                {
                    "last_affected":  "7.4-update83"
                },
                {
                    "introduced":  "7.4-update84"
                },
                {
                    "last_affected":  "7.4-update84"
                },
                {
                    "introduced":  "7.4-update85"
                },
                {
                    "last_affected":  "7.4-update85"
                },
                {
                    "introduced":  "7.4-update86"
                },
                {
                    "last_affected":  "7.4-update86"
                },
                {
                    "introduced":  "7.4-update87"
                },
                {
                    "last_affected":  "7.4-update87"
                },
                {
                    "introduced":  "7.4-update88"
                },
                {
                    "last_affected":  "7.4-update88"
                },
                {
                    "introduced":  "7.4-update89"
                },
                {
                    "last_affected":  "7.4-update89"
                },
                {
                    "introduced":  "7.4-update90"
                },
                {
                    "last_affected":  "7.4-update90"
                },
                {
                    "introduced":  "7.4-update91"
                },
                {
                    "last_affected":  "7.4-update91"
                },
                {
                    "introduced":  "7.4-update92"
                },
                {
                    "last_affected":  "7.4-update92"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "liferay:digital_experience_platform"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
2dbb47c01fa3a56555a154d38e3e40c062dfdacb
Fixed
a9017d1f654503189fcd6eecd59bd501a7015b8c
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "7.4.3.61"
        },
        {
            "fixed":  "7.4.3.132"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4599.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "103302773237074788461801313682446763330",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464",
                "202485877113214607873722865538960039931",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-4599-0b9fe555",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "target":  {
            "file":  "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "170699539902466296749337177159259793854",
            "length":  2763
        },
        "id":  "CVE-2025-4599-98b65317",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "target":  {
            "file":  "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java",
            "function":  "_upgradePortletPreferenceValues"
        }
    }
]
vanir_signatures_modified 
"2026-09-05T08:10:17Z"