Skip to content
OpenAdvisories
High WID-SEC-2025-2232 4 CVEs

Liferay Portal: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Oct 8, 2025 · Updated Oct 9, 2025 · Revision 2 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 4

  • Medium 5.1
    CVE-2025-43830

    Liferay Portal is vulnerable to Stored XSS through Forms text type field

    Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inj…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2025-43771

    Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields

    Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script o…

    Liferay DXP Portal com.liferay:com.liferay.flags.web Maven
  • Medium 4.8
    CVE-2025-43821

    Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field

    Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote attackers …

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.product.service Maven
  • Medium 4.8
    CVE-2025-43829

    Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file

    Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote atta…

    Liferay DXP Portal com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web Maven

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-33171

  2. #1

    Initiale Fassung

References