The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 update 61 through update 92 was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment…
Severity
Low 2.0
Published
4 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.132
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
From 2024.q4.1 up to 2024.q4.5
From 2024.q3.1 up to 2024.q3.13
From 2024.q2.0 up to 2024.q2.13
From 2024.q1.1 up to 2024.q1.13
All 37 release lines
Version 7.4
Version 7.4-update61
Version 7.4-update62
Version 7.4-update63
Version 7.4-update64
Version 7.4-update65
Version 7.4-update66
Version 7.4-update67
Version 7.4-update68
Version 7.4-update69
Version 7.4-update70
Version 7.4-update71
Version 7.4-update72
Version 7.4-update73
Version 7.4-update74
Version 7.4-update75
Version 7.4-update76
Version 7.4-update77
Version 7.4-update78
Version 7.4-update79
Version 7.4-update80
Version 7.4-update81
Version 7.4-update82
Version 7.4-update83
Version 7.4-update84
Version 7.4-update85
Version 7.4-update86
Version 7.4-update87
Version 7.4-update88
Version 7.4-update89
Version 7.4-update90
Version 7.4-update91
Version 7.4-update92
From 2024.q1.1 up to 2024.q1.13
From 2024.q2.0 up to 2024.q2.13
From 2024.q3.1 up to 2024.q3.13
From 2024.q4.1 up to 2024.q4.5
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal