CVE-2025-43734: Liferay Portal and DXP Reflected XSS Vulnerability
Summary
CVE-2025-43734: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability. Affects com.liferay.portal:release.portal.bom versions >= 7.4.0, <= 7.4.3.132. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides features such as user management, content management, and customizable workflows. Liferay DXP (Digital Experience Platform) extends these capabilities with additional enterprise features. The vulnerability in question affects specific versions of Liferay Portal and DXP, allowing attackers to exploit a reflected cross-site scripting (XSS) flaw, which can lead to unauthorized script execution in the context of the user’s session.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.10, among others. This vulnerability allows a remote authenticated attacker to inject malicious JavaScript code into the 'first display label' field of a custom sort widget configuration. When the page is refreshed, the injected script is executed, potentially compromising user data and session integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider disabling the custom sort widget feature or restricting access to it until the vulnerability can be addressed. Additionally, ensure that users are educated about the risks of executing untrusted scripts.
Conclusion
The reflected XSS vulnerability in Liferay Portal and DXP poses a significant risk to users by allowing attackers to execute malicious scripts. It is crucial to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
The vulnerability is a reflected cross-site scripting (XSS) flaw that allows attackers to inject and execute malicious scripts.
Affected versions include Liferay Portal 7.4.0 to 7.4.3.132 and Liferay DXP 2025.Q1.0 to 2025.Q1.10, among others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized script execution, compromising user sessions and potentially exposing sensitive data.
Yes, you can disable the affected features or restrict access to them until a patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
