CVE-2025-43779
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.112 and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92. A remote authenticated attacker can inject JavaScript via the _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. The malicious payload is reflected and executed in the user's browser.
Risk Assessment
Risk includes script execution in the victim's browser, potentially leading to session hijacking, account takeover, or other client-side attacks.
Recommendation
Update to a patched version of Liferay Portal/DXP and implement input filtering and sanitization.
Other vulnerabilities in Liferay Portal
See all- CVE-2010-5327High
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
- CVE-2022-42122Critical
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
- CVE-2022-42120Critical
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
- CVE-2020-7961CriticalActively exploited
Deserialization of untrusted data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
- CVE-2025-43783Medium
Liferay Portal 7.4.3.73 through 7.4.3.128 and Liferay DXP in specific versions are vulnerable to Reflected Cross-Site Scripting. Remote attackers can inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.
- CVE-2025-43785Medium
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128 and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92. Remote attackers can execute arbitrary web script or HTML in the My Workflow Tasks page.
- CVE-2022-42132Medium
In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.
- CVE-2022-42131Medium
Liferay products are missing SSL certificate validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
- CVE-2022-42130Medium
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
- CVE-2022-42129Medium
An IDOR vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and executed within the user's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS