A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, among others. This vulnerability allows a remote authenticated user to inject JavaScript into message board threads and categories. The issue affects multiple versions, making it critical for users to be aware of their specific installations.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-43731 |
Exploitation
To exploit this vulnerability, an attacker must be a remote authenticated user who can post in message board threads or categories. By injecting malicious JavaScript into these posts, the attacker can execute scripts in the context of other users’ sessions, potentially leading to data theft or session hijacking.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: Affected by XSS vulnerability allowing JavaScript injection.
- Liferay DXP 2025.Q1.0 through 2025.Q1.8: Vulnerable to similar XSS attacks.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: Also impacted by this security issue.
- Liferay DXP 2024.Q3.1 through 2024.Q3.13: Affected versions that allow for XSS exploitation.
- Liferay DXP 2024.Q2.0 through 2024.Q2.13: Vulnerable to the same XSS injection risks.
- Liferay DXP 2024.Q1.1 through 2024.Q1.16: Includes versions susceptible to this vulnerability.
- Liferay Portal 7.4 GA through update 92: Also affected by this XSS vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest versions of Liferay Portal and DXP that have addressed this issue. Additionally, implementing input validation and output encoding can help prevent XSS attacks. Regular security audits and user training on safe posting practices can further reduce the risk of exploitation.