A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132 and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page’s name field. This malicious payload is then reflected and executed within the user’s browser when viewing the ‘document View Usages’ page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.3 | CVE-2025-43733 |
Exploitation
To exploit this vulnerability, an attacker must be a remote authenticated user who can manipulate the content page’s name field. By injecting malicious JavaScript code into this field, the attacker can cause the code to be executed in the context of another user’s browser when they view the affected page, potentially leading to unauthorized actions or data exposure.
Affected Products
- Liferay Portal 7.4.3.132 – A web platform for building digital experiences.
- Liferay DXP 2025.Q1.0 through 2025.Q1.7 – A digital experience platform for creating and managing web applications.
Mitigation
To mitigate this vulnerability, it is recommended to sanitize and validate user inputs in the content page’s name field to prevent the injection of malicious scripts. Additionally, users should be encouraged to update to the latest versions of Liferay Portal and DXP to ensure they have the latest security patches.