Moderate severityNVD Advisory· Published Aug 23, 2025· Updated Aug 25, 2025
CVE-2025-43769
CVE-2025-43769
Description
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.plugins.admin.webMaven | < 5.0.36 | 5.0.36 |
Affected products
2- Liferay/DXPv5Range: 7.4.13
Patches
10249230a00a8LPD-39537 - escape name
1 file changed · +1 −1
modules/apps/plugins-admin/plugins-admin-web/src/main/resources/META-INF/resources/portlets.jspf+1 −1 modified@@ -74,7 +74,7 @@ portlets = ListUtil.sort(portlets, new PortletTitleComparator(application, local <aui:a href="<%= showEditPluginHREF ? rowURL.toString() : null %>"> <c:choose> <c:when test="<%= Validator.isNotNull(title) %>"> - <%= title %> + <%= HtmlUtil.escape(title) %> </c:when> <c:when test="<%= Validator.isNotNull(portlet.getDisplayName()) %>"> <%= portlet.getDisplayName() %>
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-rvmf-jw8g-r35rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43769ghsaADVISORY
- github.com/liferay/liferay-portal/commit/0249230a00a8ab42a5edaf6bca1bcf594525c0e9ghsaWEB
- liferay.atlassian.net/browse/LPE-18128ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43769ghsaWEB
News mentions
0No linked articles in our index yet.