PT-2025-36739

CVE-2025-43776

Published

2025-09-09

Updated

2025-12-16

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2024.Q1.1 through 2024.Q1.19 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2025.Q1.0 through 2025.Q1.16 Liferay DXP versions 2025.Q2.0 through 2025.Q2.9

Description: A stored cross-site scripting issue exists in Liferay Portal and Liferay DXP. A remote authenticated attacker can inject JavaScript through the Custom Object field label. The malicious payload is stored and executed through the Process Builder's Configuration tab without proper escaping.

Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.132: Update to a version later than 7.4.3.132. Liferay DXP versions 2024.Q1.1 through 2024.Q1.19: Update to a version later than 2024.Q1.19. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: Update to a version later than 2024.Q2.13. Liferay DXP versions 2024.Q3.0 through 2024.Q3.13: Update to a version later than 2024.Q3.13. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: Update to a version later than 2024.Q4.7. Liferay DXP versions 2025.Q1.0 through 2025.Q1.16: Update to a version later than 2025.Q1.16. Liferay DXP versions 2025.Q2.0 through 2025.Q2.9: Update to a version later than 2025.Q2.9.

Exploitability

Fix

Impacts

Researchers

Ndix

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-209: Generation of Error Message Containing Sensitive Information

Related identifiers

CVE-2025-43776