CVE-2025-43755: Liferay DXP Stored XSS Vulnerability

CVE-2025-43755 Overview

CVE-2025-43755 is a stored cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter of the Layout Admin portlet. A remote authenticated attacker with elevated privileges can inject JavaScript that persists in the application and executes in the browsers of subsequent users. The issue is tracked under CWE-79 and impacts numerous Liferay releases spanning Portal 7.4 GA through update 92 and multiple DXP quarterly releases.

Critical Impact
Persistent JavaScript execution in administrator or user browsers can lead to session compromise, unauthorized configuration changes, and lateral abuse of the portal's administrative functions.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132, and 7.4 GA through update 92
Liferay DXP 2024.Q1.1 through 2024.Q1.17, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7
Liferay DXP 2025.Q1.0 through 2025.Q1.13, and 2025.Q2.0

Discovery Timeline

2025-08-21 - CVE-2025-43755 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43755

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Liferay Layout Admin web module. The GroupPagesPortlet accepts a type request parameter that is rendered back into HTML without sufficient output encoding. Because the value is persisted server-side and re-rendered when the affected page is loaded, injected scripts execute in the context of any user viewing the compromised layout. Exploitation requires an authenticated session with permissions to interact with the Layout Admin functionality, which limits opportunistic exploitation but does not prevent abuse by insider threats or accounts obtained through phishing or credential reuse.

Root Cause

The defect stems from improper neutralization of user-controlled input during web page generation (CWE-79). Input supplied through the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter is stored and later reflected into rendered HTML without contextual escaping. Without HTML entity encoding or a strict Content Security Policy, browser parsers interpret attacker-controlled markup as executable script.

Attack Vector

An authenticated attacker submits a crafted type parameter value containing JavaScript payload markup to the Layout Admin portlet. The Liferay Portal instance stores the value as part of layout configuration. When another authenticated user, often an administrator, loads the affected page, the browser parses and executes the injected script under the origin of the Liferay instance. The script can exfiltrate session cookies, invoke authenticated portal APIs, or modify site configuration on behalf of the victim.

No verified public exploit code or proof-of-concept has been released. See the Liferay Security Advisory CVE-2025-43755 for vendor technical details.

Detection Methods for CVE-2025-43755

Indicators of Compromise

HTTP requests to the Layout Admin portlet containing <script>, onerror=, javascript:, or encoded angle brackets inside the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.
Layout configuration entries in the Liferay database whose type values contain HTML tags or event handler attributes.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading a Liferay layout page.

Detection Strategies

Review Liferay access logs for POST or GET requests to GroupPagesPortlet endpoints containing suspicious characters in the type parameter.
Query the portal database for stored layout type values that do not match the expected enumerated values used by Liferay (for example, portlet, content, link_to_layout).
Deploy web application firewall rules that inspect Liferay portlet parameters for script markup and known XSS payload patterns.

Monitoring Recommendations

Enable and forward Liferay audit logs and web server access logs to a centralized analytics platform for query-based hunting.
Alert on administrator sessions that trigger unusual API calls immediately after page loads under /group/, /web/, or /layout/ paths.
Track browser telemetry for Content Security Policy violations originating from Liferay-hosted origins.

How to Mitigate CVE-2025-43755

Immediate Actions Required

Upgrade Liferay Portal to a fixed release beyond 7.4.3.132 and Liferay DXP to a version newer than 2025.Q2.0 as directed by the vendor advisory.
Restrict membership in roles that grant Layout Admin privileges to a minimal set of trusted administrators.
Rotate administrator session cookies and credentials if compromise is suspected on affected instances.

Patch Information

Liferay has published fix details in the Liferay Security Advisory CVE-2025-43755. Administrators running self-managed deployments should apply the vendor-provided update for their release train. Liferay SaaS customers should confirm their tenant has been upgraded to a patched quarterly release.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and limits script sources on Liferay origins.
Place Liferay behind a web application firewall configured to block XSS payloads targeting portlet parameters.
Temporarily reduce the number of accounts holding layout management permissions until patching is complete.

bash

# Example WAF rule (ModSecurity syntax) to block script markup in the vulnerable parameter
SecRule ARGS:_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type \
  "@rx (?i)(<script|onerror=|javascript:|<img[^>]+src)" \
  "id:1004375,phase:2,deny,status:403,log,msg:'Potential CVE-2025-43755 XSS attempt'"