GHSA-22jp-w3cg-gvmm

Suggest an improvement
Source
https://github.com/advisories/GHSA-22jp-w3cg-gvmm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-22jp-w3cg-gvmm/GHSA-22jp-w3cg-gvmm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-22jp-w3cg-gvmm
Aliases
Published
2025-08-19T15:31:28Z
Modified
2025-08-19T22:42:19Z
Severity
  • 4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature
Details

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Liferay Portal is fixed on the master branch from commit c1b7c6b.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-08-19T22:23:30Z",
    "nvd_published_at":  "2025-08-19T13:15:41Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name
com.liferay.portal:release.portal.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.4.3.120-ga120
Last Affected
7.4.3.132-ga23

Affected versions

7.*
7.4.3.120-ga120
7.4.3.125
7.4.3.125-ga125
7.4.3.129
7.4.3.132

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-22jp-w3cg-gvmm/GHSA-22jp-w3cg-gvmm.json"