Skip to content
OpenAdvisories
Medium WID-SEC-2025-1877 7 CVEs

Liferay Portal und DXP: Mehrere Schwachstellen

Published Aug 20, 2025 · Updated Aug 20, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Portal

Summary

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 7

  • High 7.1
    CVE-2025-43748

    Liferay Portal Vulnerable to Cross-Site Request Forgery

    Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, 7.3 GA through update 36, and…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.9
    CVE-2025-43742

    Liferay Portal Vulnerable to Cross-Site Scripting through URLs

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay:com.liferay.layout.type.controller.display.page Maven
  • Medium 5.3
    CVE-2025-43749

    Liferay Portal Unauthenticated File Access via URL

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated user…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43741

    Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43746

    Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43750

    Liferay Portal Unvalidated File Upload

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticat…

    Liferay DXP Portal com.liferay:com.liferay.dynamic.data.mapping.form.web Maven
  • Medium 4.8
    CVE-2025-43757

    Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven

Revision history

  1. #1

    Initiale Fassung

References