CVE-2025-43781: Liferay Portal Search Bar Portlet XSS Vulnerability
Summary
CVE-2025-43781: Liferay Portal is vulnerable to XSS attack through its search bar portlet. Affects com.liferay:com.liferay.portal.search.web versions >= 6.0.125, < 6.0.143. Fixed in 6.0.143. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides a robust framework for creating customizable web experiences, including features like user management, content management, and various portlets. The search bar portlet is a critical component that allows users to search for content within the portal. However, it has been found to be vulnerable to a reflected cross-site scripting (XSS) attack, which can allow attackers to inject malicious scripts through the search functionality.
Vulnerability Detail
The vulnerability identified as CVE-2025-43781 is a reflected cross-site scripting (XSS) flaw in Liferay Portal versions 7.4.3.110 through 7.4.3.128 and Liferay DXP versions 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML via the URL in the search bar portlet. If exploited, it could lead to unauthorized actions being performed on behalf of the user, data theft, or other malicious activities.
How To Fix
Minimum fixed version
6.0.143
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the search bar portlet until the patch is applied. Additionally, implementing input validation and sanitization on the search input can help mitigate the risk of XSS attacks.
Conclusion
CVE-2025-43781 is a significant vulnerability in Liferay Portal's search bar portlet that poses a risk of XSS attacks. It is crucial for users to update to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for com.liferay:com.liferay.portal.search.web →
FAQ
CVE-2025-43781 is a reflected cross-site scripting (XSS) vulnerability found in Liferay Portal's search bar portlet that allows attackers to inject malicious scripts.
The vulnerability affects Liferay Portal versions 7.4.3.110 through 7.4.3.128 and Liferay DXP versions 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to unauthorized actions, data theft, and other malicious activities performed on behalf of the user.
If immediate updates are not possible, consider implementing input validation and sanitization on the search input as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.portal.search.web.
