Skip to content
OpenAdvisories
Medium WID-SEC-2025-1990 4 CVEs

Liferay Portal: Mehrere Schwachstellen

Published Sep 8, 2025 · Updated Sep 9, 2025 · Revision 2 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 4

  • Medium 5.1
    CVE-2025-43777

    Liferay Portal exposes 500 status when attempting login with a deleted client secret

    Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Serve…

    Liferay DXP Portal com.liferay:com.liferay.portal.security.sso.openid.connect.impl Maven
  • Medium 4.8
    CVE-2025-43763

    Liferay Portal is vulnerable to SSRF through custom object attachment fields

    A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 that affects custo…

    Liferay DXP Portal com.liferay:com.liferay.object.service Maven
  • Medium 4.8
    CVE-2025-43778

    Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

    A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and …

    Liferay DXP Portal com.liferay:com.liferay.portal.workflow.kaleo.forms.web Maven
  • Low —
    CVE-2025-43774 Rejected

    Liferay Portal is vulnerable to XSS attack through its Style Book theme

    This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified a…

    com.liferay:com.liferay.frontend.taglib.clay Maven

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-27270, EUVD-2025-27257

  2. #1

    Initiale Fassung

References