A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, among others. This vulnerability allows a remote authenticated user to inject JavaScript into message board threads and categories. It poses a medium severity risk due to its potential impact on confidentiality and integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-43731 |
Exploitation
To exploit this vulnerability, an attacker must be a remote authenticated user who can post in message board threads or categories. By injecting malicious JavaScript into these posts, the attacker can execute scripts in the context of other users’ sessions, potentially leading to data theft or session hijacking.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: A widely used platform for building web applications.
- Liferay DXP 2025.Q1.0 through 2025.Q1.8: The enterprise version of Liferay Portal with additional features.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: Another version of the enterprise platform affected by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or DXP that addresses this issue. Additionally, implementing input validation and output encoding can help prevent XSS attacks.