CVE-2025-43765 Overview
CVE-2025-43765 is a stored cross-site scripting (XSS) vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the web content text field, where user-supplied input is stored without adequate sanitization. A remote, unauthenticated attacker can inject JavaScript that executes in the browser of any user who later views the affected content.
The issue is tracked under CWE-79 and impacts a broad range of Liferay releases, including Portal 7.4.0 through 7.4.3.131 and multiple DXP quarterly releases through update 92 of 7.4 GA.
Critical Impact
Unauthenticated attackers can persistently store JavaScript payloads inside Liferay web content, enabling session hijacking, credential theft, and administrative account compromise when victims render affected pages.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.131
- Liferay DXP 2024.Q1.1–2024.Q1.13, 2024.Q2.0–2024.Q2.13, 2024.Q3.1–2024.Q3.13, and 2024.Q4.0
- Liferay DXP 7.4 GA through update 92
Discovery Timeline
- 2025-08-23 - CVE-2025-43765 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43765
Vulnerability Analysis
The vulnerability is a stored (persistent) XSS in Liferay's web content module. When an actor submits content through the text field, the platform stores the value and later renders it back to viewers without properly encoding HTML or JavaScript constructs. Because storage occurs server-side, the payload persists across sessions and executes for every user who loads the affected asset.
Stored XSS in a content management platform is particularly impactful. Liferay web content is typically rendered on public-facing pages and within authenticated portal sessions. A single injection can therefore reach anonymous site visitors and privileged administrators alike, exposing session cookies, CSRF tokens, and browser-accessible data to the attacker.
Root Cause
The root cause is missing or insufficient output encoding of user-controlled data within the web content text field, mapped to CWE-79: Improper Neutralization of Input During Web Page Generation. Liferay's rendering path fails to escape script-bearing characters before returning the content to the client, allowing arbitrary <script> tags and event handler attributes to survive into the DOM.
Attack Vector
The attack requires network access to a submission surface exposed by the target Liferay instance and does not require authentication. An attacker submits a crafted payload containing JavaScript into the affected text field. When any user subsequently browses to a page rendering that web content, the injected script runs under the origin of the Liferay site.
Refer to the Liferay Security Advisory for CVE-2025-43765 for vendor technical details. No public proof-of-concept code has been verified for this issue.
Detection Methods for CVE-2025-43765
Indicators of Compromise
- Web content records containing <script>, javascript:, or DOM event handler attributes such as onerror= or onload= in text fields
- Outbound requests from user browsers to unfamiliar domains immediately after loading Liferay pages
- Unexpected session token or cookie values appearing in web server or WAF logs referencing external hosts
Detection Strategies
- Query the Liferay content database (JournalArticle and related tables) for stored HTML tags and script-like patterns in body fields
- Monitor HTTP POST and PUT traffic to Liferay web content endpoints for payloads containing script tags or encoded JavaScript
- Deploy Content Security Policy (CSP) reporting to surface script executions from unexpected sources
Monitoring Recommendations
- Enable Liferay audit logging for web content creation and modification events, correlating with source IP and user identity
- Forward Liferay application and web server logs to a centralized analytics platform for continuous review of anomalous content changes
- Alert on any anonymous session that successfully submits or modifies web content assets
How to Mitigate CVE-2025-43765
Immediate Actions Required
- Upgrade Liferay Portal and DXP to the fixed releases identified in the Liferay Security Advisory for CVE-2025-43765
- Audit existing web content for stored script payloads and remove any injected JavaScript before restoring services
- Restrict anonymous access to content submission endpoints where business requirements allow
Patch Information
Liferay has published fixed versions and remediation guidance in the vendor advisory. Administrators should apply the patch or upgrade to a supported quarterly release beyond update 92 of DXP 7.4 GA, and beyond Portal 7.4.3.131. Consult the Liferay Security Advisory for CVE-2025-43765 for exact fixed versions.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Deploy a web application firewall rule set that blocks HTML tags and script constructs in submissions to Liferay content endpoints
- Require authentication and role-based approval before user-generated web content is published to production sites
# Example CSP header to reduce stored XSS impact on Liferay sites
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
