Skip to content
OpenAdvisories
Medium WID-SEC-2025-1865 7 CVEs

Liferay Portal und DXP: Mehrere Schwachstellen

Published Aug 19, 2025 · Updated Aug 19, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Liferay Portal Platform: Linux

Summary

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross-Site-Scripting- und Phishing-Angriffe zu starten und vertrauliche Informationen offenzulegen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 7

  • Medium 6.9
    CVE-2025-43745

    Liferay Portal CSRF Vulnerability via Endpoint Parameter

    A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 an…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.3
    CVE-2025-43739

    Liferay Portal Email Modification Vulnerability via Calendar Portlet

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated use…

    Liferay DXP Portal com.liferay:com.liferay.calendar.service Maven
  • Medium 5.3
    CVE-2025-43743

    Liferay Portal Enumeration Discrepancy in Calendars

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated re…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43737

    Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portle…

    Liferay DXP Portal com.liferay:com.liferay.journal.web Maven
  • Medium 5.1
    CVE-2025-43738

    Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2…

    Liferay DXP Portal com.liferay:com.liferay.expando.web Maven
  • Medium 5.1
    CVE-2025-43744

    Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

    A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.6
    CVE-2025-43740

    Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 a…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven

Revision history

  1. #1

    Initiale Fassung

References