Listen to this Post
This vulnerability is a Stored Cross-Site Scripting (XSS) flaw within Liferay’s notifications widget. The issue arises due to insufficient input sanitization on the “Name” field of a publication. An attacker with permissions to create or edit a publication can inject malicious JavaScript code into this field. When the publication is saved, the payload is stored in the database. Subsequently, whenever the vulnerable notifications widget displays the name of this publication, the embedded script is rendered and executed in the browser of any user viewing the notification. This allows the attacker to perform actions within the context of the victim’s session, potentially leading to session hijacking or unauthorized administrative access.
Platform: Liferay Portal/DXP
Version: 7.4.0-7.4.3.112
Vulnerability: Stored XSS
Severity: Moderate
date: 2025-09-22
Prediction: Patch expected 2025-09-29
What Undercode Say:
`curl -s https://api.github.com/advisories/GHSA-xxxx-xxxx-xxxx | jq ‘.metadata’`
`grep -r “publication.name” /liferay/webapps/ROOT/`
`docker run -it –rm liferay:7.4.3.112 cat /opt/liferay/tomcat/webapps/ROOT/WEB-INF/web.xml`
How Exploit:
`POST /api/jsonws/journal/add-`
`Payload: name=`
Protection from this CVE
Apply vendor patch. Implement strict Content Security Policy (CSP). Sanitize all user-input fields on the server-side.
Impact:
Session Hijacking
Privilege Escalation
Data Theft
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
