What is GHSA-cr36-3vqf-x5w5?

GHSA-cr36-3vqf-x5w5 is a security advisory published by GitHub Security Advisories with Critical severity. Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting

Which CVE IDs does GHSA-cr36-3vqf-x5w5 cover?

GHSA-cr36-3vqf-x5w5 covers the following CVE IDs: CVE-2024-25601. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cr36-3vqf-x5w5?

GHSA-cr36-3vqf-x5w5 has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-cr36-3vqf-x5w5?

GHSA-cr36-3vqf-x5w5 affects 3 products, including: maven/com.liferay.portal:release.portal.bom:\u003c= 7.4.2; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.3.0, \u003c 7.3.10.u4; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.2.0, \u003c 7.2.10.fp17.

GHSA-cr36-3vqf-x5w5CriticalCVSS 9.0

Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting

Vendor

GitHub Security Advisories

Published

February 21, 2024

Last Modified

March 21, 2026

🔗 CVE IDs covered (1)

CVE-2024-25601 →

📋 Description

Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.

🎯 Affected products3

maven/com.liferay.portal:release.portal.bom:<= 7.4.2
maven/com.liferay.portal:release.dxp.bom:>= 7.3.0, < 7.3.10.u4
maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp17

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-25601
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601
https://github.com/advisories/GHSA-cr36-3vqf-x5w5