What is GHSA-xpjg-7hx7-wgcx?

GHSA-xpjg-7hx7-wgcx is a security advisory published by GitHub Security Advisories with Critical severity. Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

Which CVE IDs does GHSA-xpjg-7hx7-wgcx cover?

GHSA-xpjg-7hx7-wgcx covers the following CVE IDs: CVE-2024-25147. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xpjg-7hx7-wgcx?

GHSA-xpjg-7hx7-wgcx has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

Which products are affected by GHSA-xpjg-7hx7-wgcx?

GHSA-xpjg-7hx7-wgcx affects 3 products, including: maven/com.liferay.portal:release.portal.bom:\u003c= 7.4.1; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.3.0, \u003c 7.3.10.u4; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.2.0, \u003c 7.2.10.fp15.

GHSA-xpjg-7hx7-wgcxCriticalCVSS 9.6

Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

Vendor

GitHub Security Advisories

Published

February 21, 2024

Last Modified

March 21, 2026

🔗 CVE IDs covered (1)

CVE-2024-25147 →

📋 Description

Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.

🎯 Affected products3

maven/com.liferay.portal:release.portal.bom:<= 7.4.1
maven/com.liferay.portal:release.dxp.bom:>= 7.3.0, < 7.3.10.u4
maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp15

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-25147
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147
https://github.com/advisories/GHSA-xpjg-7hx7-wgcx