A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.3, among others. This vulnerability allows a remote non-authenticated attacker to inject JavaScript into web content for friendly URLs. The issue affects multiple versions of the software, making it critical for users to address.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-43742 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious URL that includes JavaScript code. When a user clicks on the link, the injected script executes in the context of the user’s browser, potentially leading to unauthorized actions or data theft.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: A widely used platform for building web applications.
- Liferay DXP 2025.Q1.0 through 2025.Q1.3: The enterprise version of Liferay, offering additional features and support.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: Another version of the DXP platform that is also affected.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Liferay Portal or DXP that addresses the XSS issue. Additionally, implementing input validation and output encoding can help prevent similar vulnerabilities in the future.