CVE-2025-43734

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.

CVSS

No CVSS.

References

Link	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734

Configurations

No configuration.

History

13 Aug 2025, 17:33

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad cross-site scripting (XSS) reflejado en Liferay Portal (versiones 7.4.0 a 7.4.3.132) y Liferay DXP (versiones 2025.Q1.0 a 2025.Q1.10, 2024.Q4.0 a 2024.Q4.7, 2024.Q3.1 a 2024.Q3.13, 2024.Q2.1 a 2024.Q2.13, 2024.Q1.1 a 2024.Q1.16) y 7.4 GA (versión 7.4 GA) hasta la actualización 92 permite a un atacante remoto autenticado inyectar código JavaScript en el campo "first display label" de la configuración de un widget de ordenación personalizado. Esta carga maliciosa es reflejada y ejecutada por la etiqueta taglib del botón clay al actualizar la página.

12 Aug 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-12 19:15

Updated : 2025-08-13 17:33

NVD link : CVE-2025-43734

Mitre link : CVE-2025-43734

CVE.ORG link : CVE-2025-43734

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-43734", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@liferay.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-12T19:15:29.803", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734", "source": "security@liferay.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@liferay.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the \u201cfirst display label\u201d field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page."}, {"lang": "es", "value": "Una vulnerabilidad cross-site scripting (XSS) reflejado en Liferay Portal (versiones 7.4.0 a 7.4.3.132) y Liferay DXP (versiones 2025.Q1.0 a 2025.Q1.10, 2024.Q4.0 a 2024.Q4.7, 2024.Q3.1 a 2024.Q3.13, 2024.Q2.1 a 2024.Q2.13, 2024.Q1.1 a 2024.Q1.16) y 7.4 GA (versi\u00f3n 7.4 GA) hasta la actualizaci\u00f3n 92 permite a un atacante remoto autenticado inyectar c\u00f3digo JavaScript en el campo \"first display label\" de la configuraci\u00f3n de un widget de ordenaci\u00f3n personalizado. Esta carga maliciosa es reflejada y ejecutada por la etiqueta taglib del bot\u00f3n clay al actualizar la p\u00e1gina."}], "lastModified": "2025-08-13T17:33:46.673", "sourceIdentifier": "security@liferay.com"}