CVE-2025-43741: Liferay DXP XSS Vulnerability

CVE-2025-43741 Overview

CVE-2025-43741 is a reflected cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter of the Users Admin portlet. An authenticated remote attacker can inject arbitrary JavaScript that executes in the victim's browser session when the crafted URL is loaded. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. Successful exploitation can lead to session token theft, portal action abuse, and defacement of administrative interfaces used by portal operators.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the context of Liferay administrators, enabling account takeover pathways and unauthorized actions within the portal.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1.1 through 2024.Q1.14, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.1 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, and 2025.Q1.0 through 2025.Q1.3
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-08-20 - CVE-2025-43741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43741

Vulnerability Analysis

The vulnerability is a reflected XSS flaw within the UsersAdminPortlet component of Liferay Portal and Liferay DXP. When the portlet processes the assetTagNames parameter, user-supplied input is echoed back into the HTML response without adequate output encoding. An authenticated attacker can craft a URL that embeds a JavaScript payload in this parameter and deliver it to a target user, typically via social engineering. Because the injected script executes within the trust boundary of the authenticated portal session, it can invoke privileged administrative endpoints on behalf of the victim.

Root Cause

The root cause is improper neutralization of user-controlled input during HTML page generation, as classified by CWE-79. The assetTagNames request parameter is reflected into the portlet's rendered markup without HTML entity encoding or contextual sanitization, allowing markup and script content to break out of the intended data context.

Attack Vector

Exploitation requires network access to the Liferay instance, valid authentication with at least low-privilege portal access, and user interaction to trigger the crafted URL. The attacker constructs a request targeting the Users Admin portlet with a malicious assetTagNames value containing script content. When a higher-privileged user, such as a portal administrator, follows the link while authenticated, the reflected payload executes in their browser. The script inherits the victim's session context and can issue requests to any endpoint the victim can reach.

No working exploit is publicly listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Liferay Known Vulnerability advisory for CVE-2025-43741 for vendor-specific technical detail.

Detection Methods for CVE-2025-43741

Indicators of Compromise

HTTP requests to Liferay URLs containing _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames with values that include <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external or untrusted domains that initiate requests against the Users Admin portlet.
Unexpected outbound browser requests from administrator workstations shortly after accessing a Liferay administration URL.

Detection Strategies

Inspect web server and reverse proxy access logs for request parameters matching the assetTagNames field with HTML or JavaScript syntax characters.
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns targeting Liferay portlet parameters, particularly on /group/, /web/, and /o/ paths.
Correlate portal audit logs with administrator sessions to identify anomalous API calls, role assignments, or user creation events initiated from suspicious referrers.

Monitoring Recommendations

Enable verbose HTTP request logging on the Liferay tier and forward events to a centralized analytics platform for pattern searches on the vulnerable parameter.
Alert on outbound HTTP requests from administrator browsers to unknown domains immediately following authenticated Liferay sessions, which may indicate exfiltration of session data.
Track failed and successful administrative operations attributed to accounts that recently followed externally sourced links to portal URLs.

How to Mitigate CVE-2025-43741

Immediate Actions Required

Apply the vendor-supplied fix documented in the Liferay advisory for CVE-2025-43741 to all affected Portal and DXP instances.
Audit user accounts and remove unnecessary administrative privileges to reduce the impact of a successful XSS payload executed against an admin session.
Instruct portal administrators to avoid clicking Liferay URLs from untrusted sources until patching is complete.

Patch Information

Liferay has published remediation guidance in its Known Vulnerabilities portal. Upgrade Liferay Portal beyond 7.4.3.132, upgrade Liferay DXP 7.4 to a release later than update 92, and move DXP quarterly releases to the fixed maintenance versions identified in the vendor advisory.

Workarounds

Deploy WAF rules that block or sanitize requests containing HTML markup or JavaScript keywords within the assetTagNames parameter of the Users Admin portlet.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins, limiting the payload's ability to execute.
Require administrators to use dedicated browsers or profiles for Liferay administration to prevent cross-context exposure of session cookies.

bash

# Example WAF rule (ModSecurity) to block XSS in the vulnerable parameter
SecRule ARGS:_com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames \
    "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1004374,phase:2,deny,status:403,log,msg:'CVE-2025-43741 Liferay XSS attempt blocked'"