CVE-2025-3760 in Liferay
Summary
by MITRE • 04/17/2025
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/16/2025
The vulnerability identified as CVE-2025-3760 represents a critical stored cross-site scripting flaw that affects multiple versions of Liferay Portal and Liferay DXP platforms. This security weakness specifically targets radio button type custom fields within the content management system, creating a persistent vector for malicious code injection that can compromise user sessions and data integrity. The vulnerability impacts a broad range of Liferay releases including versions 7.2.0 through 7.4.3.129 and various DXP quarterly releases from 2023.Q4.0 through 2024.Q4.7, making it a widespread concern for organizations utilizing these platforms. The flaw enables remote authenticated attackers to inject malicious JavaScript code that persists in the system and executes whenever affected pages are accessed by other users, fundamentally undermining the security posture of affected deployments.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding within the custom field processing mechanisms of Liferay's platform. When administrators or users create or modify content using radio button custom fields, the system fails to properly sanitize user-provided data before storing it in the database. This stored data is then rendered without adequate security measures during page generation, allowing attackers to embed malicious JavaScript payloads that execute in the context of other users' browsers. The vulnerability manifests when the system processes radio button selections that contain script tags or other malicious content, bypassing standard security controls designed to prevent XSS attacks. This stored nature of the vulnerability means that the malicious code remains persistent and can affect multiple users over time, unlike reflected XSS variants that require specific user interactions.
The operational impact of CVE-2025-3760 extends beyond simple script execution, potentially enabling attackers to perform session hijacking, steal sensitive information, modify content, or redirect users to malicious websites. Attackers can leverage this vulnerability to access user credentials, personal data, and system administrative functions, particularly when the affected custom fields are used in contexts with elevated privileges. The persistence of stored XSS makes it particularly dangerous as the malicious code can affect users long after the initial injection occurs, creating extended attack windows and potential for data exfiltration. Organizations utilizing Liferay platforms with affected versions face significant risks including regulatory compliance violations, reputational damage, and potential financial losses due to compromised user data and system integrity. The vulnerability also creates opportunities for attackers to establish persistent backdoors or escalate privileges within the platform.
Organizations should implement immediate mitigations including applying the latest security patches and updates from Liferay as they become available, implementing comprehensive input validation for all custom field types, and deploying web application firewalls with XSS detection capabilities. Security teams should conduct thorough vulnerability assessments of all custom field implementations and review existing content for potential malicious payloads. The mitigation strategy should include enhanced monitoring of user-generated content, particularly in areas where radio button custom fields are utilized, and implementation of strict content security policies. Additionally, organizations should consider disabling or restricting the use of custom fields with known vulnerabilities until proper security controls are implemented, following the principle of least privilege and defensive security measures. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws and represents a significant concern under ATT&CK technique T1566.001 for malicious content injection, emphasizing the need for comprehensive security controls in web application platforms.