VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 18, 2025· Updated Aug 18, 2025

CVE-2025-43731

CVE-2025-43731

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.0-ga1, <= 7.4.3.132-ga132—

Affected products

2

Patches

3
f23921fc93cf

LPD-53184 - Revert

https://github.com/liferay/liferay-portalJuanjo FernandezApr 11, 2025via ghsa
commit
1 file changed · +1 −1
  • modules/apps/message-boards/message-boards-web/src/main/resources/META-INF/resources/message_boards/edit_category.jsp+1 −1 modified
    @@ -67,7 +67,7 @@ if (portletTitleBasedNavigation) {
 
 <div <%= portletTitleBasedNavigation ? "class=\"container-fluid container-fluid-max-xl container-form-lg\"" : StringPool.BLANK %>>
 	<c:if test="<%= !portletTitleBasedNavigation %>">
-		<h3><liferay-ui:message key="<%= mbHomeDisplayContext.getTitle() %>" /></h3>
+		<h3><%= mbHomeDisplayContext.getTitle() %></h3>
 	</c:if>
 
 	<portlet:actionURL name="/message_boards/edit_category" var="editCategoryURL">
cd1c692dfed3

LPD-53184 - Refactor. Escape category name

https://github.com/liferay/liferay-portalJuanjo FernandezApr 10, 2025via ghsa
commit
2 files changed · +4 −2
  • modules/apps/message-boards/message-boards-web/src/main/java/com/liferay/message/boards/web/internal/display/context/DefaultMBHomeDisplayContext.java+3 −1 modified
    @@ -9,6 +9,7 @@
 import com.liferay.message.boards.model.MBCategory;
 import com.liferay.message.boards.web.internal.display.context.helper.MBRequestHelper;
 import com.liferay.portal.kernel.language.LanguageUtil;
+import com.liferay.portal.kernel.util.HtmlUtil;
 
 import java.util.UUID;
 
@@ -36,7 +37,8 @@ public String getTitle() {
 		}
 
 		return LanguageUtil.format(
-			_mbRequestHelper.getRequest(), "edit-x", category.getName(), false);
+			_mbRequestHelper.getRequest(), "edit-x",
+			HtmlUtil.escape(category.getName()), false);
 	}
 
 	@Override
  • modules/apps/message-boards/message-boards-web/src/main/resources/META-INF/resources/message_boards/edit_message.jsp+1 −1 modified
    @@ -120,7 +120,7 @@ if (portletTitleBasedNavigation) {
 		<portlet:param name="mvcRenderCommandName" value="/message_boards/edit_message" />
 	</portlet:actionURL>
 
-	<aui:form action="<%= editMessageURL %>" data-senna-off="true" enctype="multipart/form-data" method="post" name="fm" onSubmit="event.preventDefault();">
+	<aui:form action="<%= editMessageURL %>" enctype="multipart/form-data" method="post" name="fm" onSubmit="event.preventDefault();">
 		<aui:input name="<%= Constants.CMD %>" type="hidden" />
 		<aui:input name="redirect" type="hidden" value="<%= redirect %>" />
 		<aui:input name="portletResource" type="hidden" value="<%= portletDisplay.getPortletResource() %>" />
41708aa542c1

LPD-52891 - Feat. Suscribe to spa 'screenDeactivate' to clean up editor content and prevent script injection

https://github.com/liferay/liferay-portalJuanjo FernandezApr 8, 2025via ghsa
commit
1 file changed · +13 −0
  • modules/apps/frontend-editor/frontend-editor-ckeditor-web/src/main/resources/META-INF/resources/js/ckeditor4/BaseEditor.js+13 −0 modified
    @@ -60,6 +60,19 @@ const BaseEditor = forwardRef(
 					delete window.CKEDITOR;
 				}
 			});
+
+			Liferay.once('screenDeactivate', () => {
+				if (
+					window.CKEDITOR &&
+					Object.keys(window.CKEDITOR.instances).length
+				) {
+					Object.keys(window.CKEDITOR.instances).forEach(
+						(editorName) => {
+							window.CKEDITOR.instances[editorName].setData();
+						}
+					);
+				}
+			});
 		}, []);
 
 		useEffect(() => {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.