Low severityNVD Advisory· Published Aug 18, 2025· Updated Aug 18, 2025
CVE-2025-43733
CVE-2025-43733
Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.layout.taglibMaven | < 17.0.0 | 17.0.0 |
Affected products
2- Liferay/DXPv5Range: 2025.Q1.0
Patches
12135a88adb8cLPD-52922 Escape page name
2 files changed · +2 −1
modules/apps/layout/layout-taglib/src/main/resources/META-INF/resources/layout_classed_model_usages_admin/init.jsp+1 −0 modified@@ -18,6 +18,7 @@ page import="com.liferay.layout.taglib.internal.display.context.LayoutClassedMod page import="com.liferay.layout.taglib.internal.display.context.LayoutClassedModelUsagesManagementToolbarDisplayContext" %><%@ page import="com.liferay.portal.kernel.language.LanguageUtil" %><%@ page import="com.liferay.portal.kernel.util.GetterUtil" %><%@ +page import="com.liferay.portal.kernel.util.HtmlUtil" %><%@ page import="com.liferay.portal.kernel.util.ListUtil" %> <%@ page import="java.util.List" %><%@
modules/apps/layout/layout-taglib/src/main/resources/META-INF/resources/layout_classed_model_usages_admin/page.jsp+1 −1 modified@@ -68,7 +68,7 @@ LayoutClassedModelUsagesDisplayContext layoutClassedModelUsagesDisplayContext = <liferay-ui:search-container-column-text cssClass="table-cell-expand table-cell-minw-200 table-title" name="name" - value="<%= layoutClassedModelUsagesDisplayContext.getLayoutClassedModelUsageName(layoutClassedModelUsage) %>" + value="<%= HtmlUtil.escape(layoutClassedModelUsagesDisplayContext.getLayoutClassedModelUsageName(layoutClassedModelUsage)) %>" /> <liferay-ui:search-container-column-text
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-vhcr-hgc8-29qrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43733ghsaADVISORY
- github.com/liferay/liferay-portal/commit/2135a88adb8c7f1a6cb4fbd768fef3b08953a50cghsaWEB
- liferay.atlassian.net/browse/LPE-18218ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43733ghsaWEB
News mentions
0No linked articles in our index yet.