Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Liferay Portal and DXP allow attackers to inject malicious code

CVE-2025-43778 · published 1 year ago
Summary

An attacker who has access to a Liferay Portal or DXP account can inject malicious code into the system, potentially allowing them to take control of the application or steal sensitive information. This is a serious security risk that should be addressed as soon as possible. Liferay users should update their software to the latest version to prevent exploitation.

What to do
  • Update liferay com.liferay:com.liferay.portal.workflow.kaleo.forms.web to version 5.0.107.
Affected software
Ecosystem VendorProductAffected versions
maven liferay com.liferay:com.liferay.portal.workflow.kaleo.forms.web >= 5.0.3, < 5.0.107
Fix: upgrade to 5.0.107
– liferay digital_experience_platform >= 2024.q1.1, < 2024.q1.21
>= 2024.q2.0, <= 2024.q2.13
>= 2024.Q3.0, <= 2024.Q3.13
>= 2024.q4.0, <= 2024.q4.7
>= 2025.Q1.0, < 2025.Q1.17
>= 2025.Q2.0, < 2025.Q2.12
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
– liferay liferay_portal >= 7.4.0, <= 7.4.3.132
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Original advisory text
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, ...
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-cpg4-qcj8-42gp · GHSA
CVE-2025-43778 · NVD
Track software like this
Free during beta