Skip to content
OpenAdvisories
Medium WID-SEC-2025-2106 4 CVEs

Liferay Portal und DXP: Mehrere Schwachstellen

Published Sep 22, 2025 · Updated Sep 22, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Portal

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen und Daten zu manipulieren.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 4

  • Medium 6.9
    CVE-2025-43814

    Liferay Portal and DXP audit events record password reminder answers

    In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder …

    Liferay DXP Portal com.liferay:com.liferay.portal.security.audit.event.generators.user.management Maven
  • Medium 5.3
    CVE-2025-43806

    Liferay Portal and DXP does not properly check permission with import and export tasks

    Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated …

    Liferay DXP Portal com.liferay:com.liferay.headless.batch.engine.impl Maven
  • Medium 5.3
    CVE-2025-43810

    Liferay Portal and DXP allows users to add a note to a different virtual instance

    Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated user…

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.service Maven
  • Medium 4.8
    CVE-2025-43807

    Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field

    Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject ar…

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.service Maven

Revision history

  1. #1

    Initiale Fassung

References