VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 10, 2025· Updated Sep 10, 2025

CVE-2025-43785

CVE-2025-43785

Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.3.45, < 7.4.3.1297.4.3.129
com.liferay.portal:release.dxp.bomMaven
>= 2024.Q2.0, < 2024.Q3.02024.Q3.0
com.liferay.portal:release.dxp.bomMaven
>= 2024.Q1.1, < 2024.Q1.132024.Q1.13
com.liferay.portal:release.dxp.bomMaven
>= 7.4.13.u14, <= 7.4.13.u92—
com.liferay:com.liferay.portal.workflow.task.webMaven
< 5.0.755.0.75

Affected products

2

Patches

1
5f1a7c347c81

LPD-32664 Escape user name

https://github.com/liferay/liferay-portalPedro TavaresJul 29, 2024via ghsa
commit
1 file changed · +2 −2
  • modules/apps/portal-workflow/portal-workflow-task-web/src/main/resources/META-INF/resources/view.jsp+2 −2 modified
    @@ -106,7 +106,7 @@ else {
 								<liferay-ui:message key="<%= workflowTaskDisplayContext.getAssetType(workflowTask) %>" />
 							</span>
 							<span class="author">
-								<liferay-ui:message key="<%= workflowTask.getUserName() %>" />
+								<liferay-ui:message key="<%= HtmlUtil.escape(workflowTask.getUserName()) %>" />
 							</span>
 							<span class="task-name" id="<%= String.valueOf(workflowTask.getWorkflowTaskId()) %>">
 								<liferay-ui:message key="<%= workflowTask.getLabel(workflowTaskDisplayContext.getTaskContentLocale()) %>" />
@@ -162,7 +162,7 @@ else {
 					<liferay-ui:search-container-column-text
 						href="<%= rowURL %>"
 						name="author"
-						value="<%= workflowTask.getUserName() %>"
+						value="<%= HtmlUtil.escape(workflowTask.getUserName()) %>"
 					/>
 
 					<liferay-ui:search-container-column-text

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.