CVE-2025-43731: Liferay Portal Vulnerable to Reflected Cross-Site Scripting
Summary
CVE-2025-43731: Liferay Portal Vulnerable to Cross-Site Scripting. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0-ga1, <= 7.4.3.132-ga132. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and portals. It offers features such as content management, collaboration tools, and user management. The affected version, ranging from 7.4.0 to 7.4.3.132, is widely utilized in enterprise environments, making it crucial to address vulnerabilities that could compromise user security.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132. This vulnerability allows remote authenticated users to inject malicious JavaScript into message board threads and categories. The issue arises from improper validation of user input, which can lead to unauthorized script execution in the context of other users' browsers, potentially exposing sensitive information or allowing further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before being displayed in message boards. Implement Content Security Policy (CSP) headers to mitigate the risk of XSS attacks.
Conclusion
The reflected XSS vulnerability in Liferay Portal versions 7.4.0 to 7.4.3.132 poses a significant risk to users. It is essential to apply the recommended updates or implement workarounds to safeguard against potential attacks. Regular monitoring and vulnerability assessments using tools like Vulert can help maintain application security.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2025-43731 is a vulnerability in Liferay Portal that allows reflected cross-site scripting (XSS) attacks, enabling remote authenticated users to inject malicious scripts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without signup.
The vulnerability can lead to unauthorized script execution in users' browsers, potentially compromising sensitive data and allowing attackers to perform actions on behalf of users.
Yes, a patch is available. Users should upgrade to Liferay Portal version 7.4.3.133 or later to mitigate the vulnerability.
If immediate updates are not possible, implement input validation and sanitization, and consider using Content Security Policy (CSP) headers as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
