A stored DOM-based Cross-Site Scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.5, among others. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels, which are then inserted into the DOM using innerHTML without proper encoding. This can lead to unauthorized actions and data exposure.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43744 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious DDM structure field label that includes JavaScript code. When this label is processed by the Asset Publisher configuration UI, the JavaScript is executed in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q2.0 through 2025.Q2.5
- Liferay DXP 2025.Q1.0 through 2025.Q1.15
- Liferay DXP 2024.Q4.0 through 2024.Q4.7
- Liferay DXP 2024.Q3.1 through 2024.Q3.13
- Liferay DXP 2024.Q2.0 through 2024.Q2.13
- Liferay DXP 2024.Q1.1 through 2024.Q1.19
- Liferay Portal 7.4 GA through update 92
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or Liferay DXP that addresses this issue. Additionally, implementing proper input validation and output encoding practices can help prevent XSS vulnerabilities.