CVE-2025-43822: Liferay DXP Stored XSS Vulnerability

CVE-2025-43822 Overview

CVE-2025-43822 covers multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay Digital Experience Platform (DXP). Affected versions include Liferay Portal 7.4.3.15 through 7.4.3.111, Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92. Authenticated remote attackers can inject arbitrary HTML or JavaScript via the Terms and Condition Name text field used for Payment Terms or the Delivery Term on the view order page. The payload executes in the browser of any user who later views the affected order page. The flaw is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored XSS in commerce order workflows allows attackers to hijack sessions, perform actions as privileged users, and pivot deeper into Liferay-managed portals.

Affected Products

Liferay Portal 7.4.3.15 through 7.4.3.111
Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
Liferay DXP 7.4 update 15 through update 92

Discovery Timeline

2025-10-07 - CVE-2025-43822 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43822

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Liferay Commerce order management workflow. The Name text field of a Terms and Condition entry fails to properly neutralize HTML and script content before persistence. When an administrator or operator defines a Payment Term or Delivery Term, the attacker-controlled value is stored verbatim in the database. The view order page later renders that stored string inside the HTML document without appropriate output encoding. Any authenticated user viewing an order containing the tainted term triggers execution of attacker JavaScript in their browser session. Because the payload runs in the context of the Liferay origin, it inherits the victim's session cookies, CSRF tokens, and portal permissions.

Root Cause

The root cause is missing output encoding on the Terms and Condition Name attribute when rendered on the view order page. Liferay's template layer serializes the stored string into the DOM without applying HTML entity escaping. This is a classic [CWE-79] stored XSS pattern where input validation and output encoding are both absent on a specific rendering path, even if other views of the same field may be encoded correctly.

Attack Vector

Exploitation requires network access to the Liferay portal and a low-privilege authenticated account with permission to create or edit Payment Terms or Delivery Terms. The attacker crafts a term whose Name field contains an HTML payload such as a <script> block or an event handler on an injected element. The payload is persisted in Liferay's data store. When any user, including a higher-privileged administrator, opens an order referencing that term, the browser parses the tainted markup and executes the attacker's script. Typical post-exploitation actions include session token theft, in-portal CSRF, forced configuration changes, and credential harvesting via injected forms.

Detection Methods for CVE-2025-43822

Indicators of Compromise

Terms and Condition records whose Name field contains <script>, onerror=, onload=, javascript:, or encoded variants of HTML tag delimiters.
Unexpected outbound requests from browser sessions viewing order pages to attacker-controlled domains.
Portal audit log entries showing creation or edit of Payment Terms or Delivery Terms by low-privilege commerce accounts followed by administrator views of related orders.

Detection Strategies

Query the Liferay database tables backing Terms and Conditions for Name values containing HTML tag characters (<, >) or event-handler substrings.
Deploy Content Security Policy (CSP) reporting to surface inline-script violations originating from /commerce or order view URLs.
Review web server and application logs for POST requests to Terms and Conditions endpoints with payload bodies containing script-like patterns.

Monitoring Recommendations

Alert on new or modified Terms and Conditions created by accounts that do not normally manage commerce configuration.
Monitor browser-side error telemetry and CSP violation reports for anomalies tied to order view pages.
Correlate privileged administrator sessions viewing orders with subsequent unusual API calls originating from the same session.

How to Mitigate CVE-2025-43822

Immediate Actions Required

Upgrade Liferay Portal to a release later than 7.4.3.111 and Liferay DXP to a version above the listed affected ranges, per the Liferay CVE-2025-43822 advisory.
Audit existing Terms and Conditions records and remove any entries whose Name field contains HTML or script content.
Restrict permission to create or edit Payment Terms and Delivery Terms to a minimal set of trusted commerce administrators.

Patch Information

Liferay has published remediation guidance in the vendor advisory at liferay.dev. Apply the fixed Portal or DXP release corresponding to your deployment branch. Customers on 2023.Q3 or 2023.Q4 DXP tracks should move to the next quarterly release that includes the fix, and 7.4 DXP deployments should move beyond update 92.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of stored XSS payloads.
Place a web application firewall rule in front of the commerce Terms and Conditions endpoints to reject requests whose Name parameter contains HTML tag characters or script keywords.
Temporarily revoke edit permissions on Payment Terms and Delivery Terms for non-administrative roles until the patch is applied.

bash

# Example CSP header to limit stored XSS impact on Liferay order pages
Content-Security-Policy: default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'; \
  report-uri /csp-report