VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 19, 2025· Updated Aug 20, 2025

CVE-2025-43744

CVE-2025-43744

Description

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.0-ga1, <= 7.4.3.132-ga132—

Affected products

2

Patches

2
3b36fadfe924

LPD-59048 Add Test

https://github.com/liferay/liferay-portalSam ZiemerJul 7, 2025via ghsa
commit
2 files changed · +74 −0
  • modules/apps/asset/asset-test/src/testIntegration/java/com/liferay/asset/model/test/DDMStructureClassTypeTest.java+9 −0 modified
    @@ -6,6 +6,7 @@
 package com.liferay.asset.model.test;
 
 import com.liferay.arquillian.extension.junit.bridge.junit.Arquillian;
+import com.liferay.asset.kernel.model.ClassTypeField;
 import com.liferay.asset.model.DDMStructureClassType;
 import com.liferay.data.engine.rest.dto.v2_0.DataDefinition;
 import com.liferay.data.engine.rest.resource.v2_0.DataDefinitionResource;
@@ -17,6 +18,7 @@
 import com.liferay.portal.kernel.test.rule.DeleteAfterTestRun;
 import com.liferay.portal.kernel.test.util.GroupTestUtil;
 import com.liferay.portal.kernel.test.util.TestPropsValues;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.ListUtil;
 import com.liferay.portal.kernel.util.LocaleUtil;
 import com.liferay.portal.kernel.util.StringUtil;
@@ -71,6 +73,13 @@ public void testGetClassTypeFields() throws Exception {
 				ddmStructureClassType.getClassTypeFields(),
 				classTypeField -> Objects.equals(
 					classTypeField.getType(), "date_time")));
+
+		ClassTypeField classTypeField = ddmStructureClassType.getClassTypeField(
+			"Text38954058");
+
+		Assert.assertEquals(
+			classTypeField.getLabel(),
+			HtmlUtil.escape("<script>alert(document.cookie)</script>"));
 	}
 
 	@Inject
  • modules/apps/asset/asset-test/src/testIntegration/resources/com/liferay/asset/model/test/dependencies/data-definition.json+65 −0 modified
    @@ -754,6 +754,61 @@
 			"tip": {
 				"en_US": ""
 			}
+		},
+		{
+			"customProperties": {
+				"confirmationErrorMessage": {
+					"en_US": ""
+				},
+				"confirmationLabel": {
+					"en_US": ""
+				},
+				"dataType": "string",
+				"direction": [
+					"vertical"
+				],
+				"displayStyle": "singleline",
+				"fieldNamespace": "",
+				"fieldReference": "Text38954058",
+				"hideField": false,
+				"htmlAutocompleteAttribute": "",
+				"labelAtStructureLevel": true,
+				"nativeField": false,
+				"objectFieldName": "",
+				"options": {
+				},
+				"placeholder": {
+					"en_US": ""
+				},
+				"requireConfirmation": false,
+				"requiredErrorMessage": {
+					"en_US": ""
+				},
+				"tooltip": {
+					"en_US": ""
+				},
+				"visibilityExpression": ""
+			},
+			"defaultValue": {
+				"en_US": ""
+			},
+			"fieldType": "text",
+			"indexType": "keyword",
+			"indexable": true,
+			"label": {
+				"en_US": "<script>alert(document.cookie)</script>"
+			},
+			"localizable": true,
+			"name": "Text38954058",
+			"nestedDataDefinitionFields": [
+			],
+			"readOnly": false,
+			"repeatable": false,
+			"required": false,
+			"showLabel": true,
+			"tip": {
+				"en_US": ""
+			}
 		}
 	],
 	"defaultDataLayout": {
@@ -951,6 +1006,16 @@
 								]
 							}
 						]
+					},
+					{
+						"dataLayoutColumns": [
+							{
+								"columnSize": 12,
+								"fieldNames": [
+									"Text38954058"
+								]
+							}
+						]
 					}
 				],
 				"description": {
c07a490b3d37

LPD-59048 Escape label text

https://github.com/liferay/liferay-portalSam ZiemerJul 2, 2025via ghsa
commit
2 files changed · +6 −2
  • modules/apps/asset/asset-api/src/main/java/com/liferay/asset/model/DDMStructureClassType.java+4 −1 modified
    @@ -14,6 +14,7 @@
 import com.liferay.petra.function.transform.TransformUtil;
 import com.liferay.portal.kernel.exception.PortalException;
 import com.liferay.portal.kernel.util.ArrayUtil;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.ListUtil;
 import com.liferay.portal.kernel.util.LocaleUtil;
 import com.liferay.portal.kernel.util.Validator;
@@ -100,7 +101,9 @@ protected List<ClassTypeField> getClassTypeFields(long ddmStructureId)
 				return new ClassTypeField(
 					ddmStructure.getStructureId(),
 					ddmFormField.getFieldReference(),
-					label.getString(LocaleUtil.fromLanguageId(_languageId)),
+					HtmlUtil.escape(
+						label.getString(
+							LocaleUtil.fromLanguageId(_languageId))),
 					ddmFormField.getName(), type);
 			});
 	}
  • modules/apps/journal/journal-service/src/main/java/com/liferay/journal/internal/util/JournalDefaultTemplateProviderImpl.java+2 −1 modified
    @@ -14,6 +14,7 @@
 import com.liferay.portal.kernel.template.TemplateHandlerRegistryUtil;
 import com.liferay.portal.kernel.template.TemplateVariableDefinition;
 import com.liferay.portal.kernel.template.TemplateVariableGroup;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.LocaleUtil;
 
 import java.util.Collection;
@@ -73,7 +74,7 @@ ddmStructureId, getLanguage(),
 				templateVariableDefinition.generateCode(getLanguage())[0];
 
 			sb.append("<dt class=\"text-capitalize\">");
-			sb.append(templateVariableDefinition.getLabel());
+			sb.append(HtmlUtil.escape(templateVariableDefinition.getLabel()));
 			sb.append("</dt><dd>");
 			sb.append(code);
 			sb.append("</dd>");

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.