CVE-2025-43757 json
Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter
published 2025-08-20 14 mo ago modified 2026-06-17 4 mo ago also GHSA-62pf-hcwj-rcfc , EUVD-2025-25396
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.
Patch / fix
- liferay digital_experience_platform 2024.Q1.19, 2025.Q1.15, 2025.Q2.3
- github.com/liferay/liferay-portal@0114bb6 commit
- github.com/liferay/liferay-portal@0837982 commit
- github.com/liferay/liferay-portal@45492d3 commit
- github.com/liferay/liferay-portal@90396a2 commit
- github.com/liferay/liferay-portal@9e0026c commit
- github.com/liferay/liferay-portal@cc46176 commit
- github.com/liferay/liferay-portal@d001c5b commit
- github.com/liferay/liferay-portal@e83d102 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.0-ga1, <=7.4.3.132-ga132 |
no fix listed |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/liferay/liferay-portal/commit/0114bb60238e5ac74b90fba37fa9748c4e6c114a
web
-
github.com
/liferay/liferay-portal/commit/0837982b91c5f9e837ec11a93f7e0986e00738fa
web
-
github.com
/liferay/liferay-portal/commit/45492d30bad4084f36e87ef11c29a5bf5fb4046d
web
-
github.com
/liferay/liferay-portal/commit/90396a201d05be5840f99f7487578aab253dfa87
web
-
github.com
/liferay/liferay-portal/commit/9e0026c8aa444937a2bfd079bcca35ab3dd18f5a
web
-
github.com
/liferay/liferay-portal/commit/cc46176ba4142f470d540f2343b36f12a678a240
web
-
github.com
/liferay/liferay-portal/commit/d001c5ba8a1477755d7d83b8a00aba23036b045b
web
-
github.com
/liferay/liferay-portal/commit/e83d102bf00af3aa4396c1fc5a1d6b3842ccaeb1
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43757
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18259
web
Sources
- CVE List CVE-2025-43757
- GitHub Advisory GHSA-62pf-hcwj-rcfc
- NVD CVE-2025-43757
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.