A stored DOM-based Cross-Site Scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.5, among others. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels, which are then inserted into the DOM using innerHTML without proper encoding. This can lead to unauthorized actions and data exposure.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43744 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious DDM structure field label that includes JavaScript code. When this label is processed by the Asset Publisher configuration UI, the JavaScript is executed in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Liferay Portal 7.4.0 to 7.4.3.132: Affected versions of the portal software that allow for XSS attacks through the Asset Publisher configuration.
- Liferay DXP 2025.Q2.0 to 2025.Q2.5: Affected versions of the Digital Experience Platform that are vulnerable to the same XSS issue.
- Liferay DXP 2024 and earlier versions: Multiple versions including 2024.Q4.0 to 2024.Q4.7 and others are also affected.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Liferay Portal or Liferay DXP that addresses this XSS issue. Additionally, implementing proper input validation and output encoding practices can help prevent similar vulnerabilities in the future.