Listen to this Post
How the CVE Works:
This CVE exploits a reflected XSS vulnerability in Liferay Portal (7.4.0–7.4.3.131) and Liferay DXP (2024.Q4.0–2024.Q4.7, 2024.Q3.1–2024.Q3.13, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.12, 7.4 GA–update 92). Attackers inject malicious JavaScript via the `google_gadget` parameter, which is reflected back in the response without proper sanitization. Non-authenticated remote attackers can execute arbitrary scripts in a victim’s browser, potentially stealing sessions or redirecting users to malicious sites.
DailyCVE Form:
Platform: Liferay Portal/DXP
Version: 7.4.0–7.4.3.131
Vulnerability: Reflected XSS
Severity: Moderate
Date: Aug 12, 2025
Prediction: Patch by Sep 2025
What Undercode Say:
curl -X GET "http://vulnerable-liferay/portal?google_gadget=<script>alert('XSS')</script>"
// Proof-of-Concept (PoC)
fetch(<code>/portal?google_gadget=${encodeURIComponent('<script>evil()</script>')}</code>);
How Exploit:
1. Craft malicious URL with XSS payload.
2. Trick user into clicking link.
3. Script executes in victim’s browser.
Protection from this CVE:
1. Upgrade to patched versions.
2. Input sanitization.
3. CSP headers.
Impact:
Session hijacking
Phishing attacks
Data theft
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
