A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.3, among others. This vulnerability allows a remote authenticated attacker to inject JavaScript into the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter. The issue can lead to unauthorized actions being performed on behalf of users.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43741 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious request that includes JavaScript code in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter. When a user interacts with the affected portal, the injected script can execute in the context of the user’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: A widely used platform for building web applications.
- Liferay DXP 2025.Q1.0 through 2025.Q1.3: The enterprise version of Liferay Portal with additional features.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: Affected versions of the DXP platform.
- Liferay DXP 2024.Q3.1 through 2024.Q3.13: Another set of affected DXP versions.
- Liferay DXP 2024.Q2.0 through 2024.Q2.13: Additional affected versions.
- Liferay DXP 2024.Q1.1 through 2024.Q1.14: Earlier versions also impacted.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Liferay Portal and DXP that have addressed this issue. Additionally, implementing input validation and sanitization measures can help prevent XSS attacks.