VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 9, 2025· Updated Sep 9, 2025

CVE-2025-43775

CVE-2025-43775

Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.client.extension.webMaven
>= 1.0.71, < 2.0.272.0.27

Affected products

2

Patches

1
e54b2b41564d

LPD-39400 Fix client extension title display

https://github.com/liferay/liferay-portalIván Zaera AvellónOct 16, 2024via ghsa
commit
2 files changed · +3 −2
  • modules/apps/client-extension/client-extension-web/src/main/resources/META-INF/resources/admin/edit_client_extension_entry.jsp+1 −1 modified
    @@ -38,7 +38,7 @@ renderResponse.setTitle(editClientExtensionEntryDisplayContext.getTitle());
 	</liferay-ui:error>
 
 	<liferay-frontend:edit-form-body>
-		<h3 class="mb-3"><%= editClientExtensionEntryDisplayContext.getTitle() %></h3>
+		<h3 class="mb-3"><%= HtmlUtil.escape(editClientExtensionEntryDisplayContext.getTitle()) %></h3>
 
 		<p class="text-secondary"><%= editClientExtensionEntryDisplayContext.getHelpLabel() %>
 			<liferay-learn:message
  • modules/apps/client-extension/client-extension-web/src/main/resources/META-INF/resources/admin/init.jsp+2 −1 modified
    @@ -36,7 +36,8 @@ page import="com.liferay.learn.LearnMessageUtil" %><%@
 page import="com.liferay.portal.kernel.feature.flag.FeatureFlagManagerUtil" %><%@
 page import="com.liferay.portal.kernel.language.LanguageUtil" %><%@
 page import="com.liferay.portal.kernel.service.WorkflowDefinitionLinkLocalServiceUtil" %><%@
-page import="com.liferay.portal.kernel.util.HashMapBuilder" %>
+page import="com.liferay.portal.kernel.util.HashMapBuilder" %><%@
+page import="com.liferay.portal.kernel.util.HtmlUtil" %>
 
 <%@ page import="java.lang.reflect.Method" %>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.