A Stored cross-site scripting vulnerability exists in Liferay Portal versions 7.4.3.120 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.8, among others. This vulnerability allows a remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface. The issue is classified as medium severity due to the potential for unauthorized script execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2025-43740 |
Exploitation
To exploit this vulnerability, an attacker must be authenticated and can leverage the message boards feature to inject malicious JavaScript code. This code can then be executed in the context of other users who view the affected message board, potentially leading to data theft or session hijacking.
Affected Products
- Liferay Portal 7.4.3.120 through 7.4.3.132: A web platform for building digital experiences.
- Liferay DXP 2025.Q2.0 through 2025.Q2.8: A digital experience platform for creating personalized user experiences.
- Liferay DXP 2025.Q1.0 through 2025.Q1.15: Earlier version of the DXP with similar vulnerabilities.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: Affected versions of the DXP platform.
- Liferay DXP 2024.Q3.1 through 2024.Q3.13: Another set of affected versions.
- Liferay DXP 2024.Q2.1 through 2024.Q2.13: Additional affected versions.
- Liferay DXP 2024.Q1.9 through 2024.Q1.19: Earlier versions also impacted.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest versions of Liferay Portal and DXP that address this issue. Additionally, implementing input validation and sanitization on user inputs can help prevent script injection attacks.