Skip to content
OpenAdvisories
Medium WID-SEC-2025-2151 7 CVEs

Liferay Portal und DXP: Mehrere Schwachstellen

Published Sep 29, 2025 · Updated Sep 29, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial of Service herbeizuführen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 7

  • Medium 6.9
    CVE-2025-43813

    Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet

    Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 …

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.1
    CVE-2025-43815

    Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

    Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the …

    Liferay DXP Portal com.liferay:com.liferay.product.navigation.control.menu.web Maven
  • Medium 4.8
    CVE-2025-43811

    Liferay Portal vulnerable to cross-site scripting in the related asset selector

    Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote au…

    Liferay DXP Portal com.liferay:com.liferay.item.selector.web Maven
  • Medium 4.8
    CVE-2025-43812

    Liferay Portal vulnerable to cross-site scripting in the web content template

    Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject ar…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43817

    Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

    Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrar…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43818

    Liferay Portal vulnerable to cross-site scripting in the Calendar widget

    Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36 allows…

    Liferay DXP Portal com.liferay:com.liferay.calendar.web Maven
  • Medium 4.8
    CVE-2025-43820

    Liferay Portal vulnerable to cross-site scripting in the Calendar widget

    Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, …

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven

Revision history

  1. #1

    Initiale Fassung

References