A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.2, among others. This vulnerability allows a remote authenticated attacker to inject JavaScript code via specific parameters. The issue affects multiple versions of the software, making it critical for users to address.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43746 |
Exploitation
To exploit this vulnerability, an attacker must be authenticated and can inject malicious JavaScript code through the specified parameters in the Liferay Portal. This can lead to unauthorized actions being performed on behalf of the user or the exposure of sensitive information.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q2.0 through 2025.Q2.2
- Liferay DXP 2025.Q1.0 through 2025.Q1.10
- Liferay DXP 2024.Q4.0 through 2024.Q4.7
- Liferay DXP 2024.Q3.0 through 2024.Q3.13
- Liferay DXP 2024.Q2.0 through 2024.Q2.13
- Liferay DXP 2024.Q1.1 through 2024.Q1.18
- Liferay Portal 7.4 GA through update 92
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Liferay Portal or DXP that addresses this issue. Additionally, implementing input validation and sanitization measures can help prevent XSS attacks.