CVE-2025-43733 Reflected XSS with page name in document View Usages

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal and Liferay DXP allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

 

Severity

2.3 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)

Affected Version(s)

  • Liferay Portal 7.4.3.132
  • Liferay DXP 2025.Q1.0 through 2025.Q1.7

Fixed Version(s)

  • Liferay Portal fixed on master branch
  • Liferay DXP 2025.Q2.0
  • Liferay DXP 2025.Q1.8
  • Liferay DXP 2024.Q1.17

Publication date: Mon, 28 Apr 2025 12:59:00 +0000

Security advisories for Liferay's enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.

Community
Company
Feedback
Copyright © 2025 Liferay, Inc • Privacy Policy

Powered by Liferay™