Skip to content
OpenAdvisories
Medium WID-SEC-2025-2076 3 CVEs

Liferay Portal: Mehrere Schwachstellen

Published Sep 16, 2025 · Updated Sep 17, 2025 · Revision 2 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Denial of Service oder Cross Site Scripting Angriff durchzuführen und Informationen offenzulegen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 3

  • Medium 6.9
    CVE-2025-43801

    Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC

    Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupp…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 6.9
    CVE-2025-43805

    Liferay Portal allows remote attackers to view display page templates via crafted URLs

    Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows rem…

    Liferay DXP Portal com.liferay:com.liferay.asset.display.page.service Maven
  • Medium 5.1
    CVE-2025-43804

    Liferay search widget vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_search_we…

    Liferay DXP Portal com.liferay:com.liferay.portal.search Maven

Revision history

  1. #2

    Referenz(en) aufgenommen: GHSA-5PP7-M8X8-RC82

  2. #1

    Initiale Fassung

References

  • Liferay Known Vulnerabilities vom 2025-09-16
    https://liferay.dev/portal/security/known-vulnerabilities
  • Liferay Known Vulnerabilities vom 2025-09-16
    https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-43801?p_r_p_assetEntryId=123863033&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_type=content&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_urlTitle=cve-2025-43801&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D123863033%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
  • Liferay Known Vulnerabilities vom 2025-09-16
    https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-43805?p_r_p_assetEntryId=123868637&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_type=content&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_urlTitle=cve-2025-43805&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D123868637%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
  • Liferay Known Vulnerabilities vom 2025-09-16
    https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-43804?p_r_p_assetEntryId=123869951&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_type=content&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_urlTitle=cve-2025-43804&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D123869951%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse