CVE-2024-25603
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
CVE-2024-25603- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-0499
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
EUVD-2024-0499- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-44jg-jgjx-3xg5
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
GHSA-44jg-jgjx-3xg5- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
CVE-2024-25603- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
CVE-2024-25603- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-44jg-jgjx-3xg5
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
- Record
GHSA-44jg-jgjx-3xg5- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven | through 7.4.3.4 | 7.4.3.5 |
com.liferay.portal:release.dxp.bomMaven | 7.4.13.u1 to 7.4.13.u102 | None known |
com.liferay.portal:release.dxp.bomMaven | 7.3.10.ep3 up to 7.3.10.u4 | 7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven | 7.2.0 up to 7.2.10.fp17 | 7.2.10.fp17 |
com.liferay.portal:release.portal.bomMaven | before 7.4.3.5, plus listed versions 7.0.67.0.6-17.0.6-27.1.07.1.1 Show 24 moreShow less7.1.27.1.37.1.3-17.2.07.2.17.2.1-17.3.07.3.0-17.3.17.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.4 | 7.4.3.5 |
com.liferay.portal:release.dxp.bomMaven | 7.4.13.u1 to 7.4.13.u102, plus listed versions 7.4.13.u107.4.13.u1007.4.13.u1017.4.13.u157.4.13.u16 Show 45 moreShow less7.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u547.4.13.u557.4.13.u567.4.13.u57 | None known |
com.liferay.portal:release.dxp.bomMaven | 7.3.10.ep3 up to 7.3.10.u4, plus listed versions 7.3.10.ep47.3.10.ep57.3.10.fp17.3.10.fp2 | 7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven | 7.2.0 up to 7.2.10.fp17, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 14 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp147.2.10.fp157.2.10.fp167.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 | 7.2.10.fp17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25603 is a critical vulnerability (CVSS 9.0) in Liferay Dxp, published February 21, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.5.
References
Left out here: 46 versions. The JSON record has them.