N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43733

CVE-2025-43733: Liferay Portal Vulnerable to Cross-Site Scripting

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

Liferay Portal is fixed on the master branch from commit 2135a88.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43733

CVE-2025-43733:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.layout.taglib	maven	< 17.0.0	17.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 2135a88 clearly indicates a fix for a reflected Cross-Site Scripting (XSS) vulnerability. The patch was applied to modules/apps/layout/layout-taglib/src/main/resources/META-INF/resources/layout_classed_model_usages_admin/page.jsp.

The core of the vulnerability lies in the fact that the name of a content page was being rendered without proper sanitization. The commit diff shows that the value returned by the getLayoutClassedModelUsageName method, part of the LayoutClassedModelUsagesDisplayContext class, was previously being output directly to the page. The fix involves wrapping this method's output with HtmlUtil.escape(), a standard Liferay utility for preventing XSS.

This directly points to com.liferay.layout.taglib.internal.display.context.LayoutClassedModelUsagesDisplayContext.getLayoutClassedModelUsageName as the function providing the tainted data that leads to the vulnerability. During exploitation, this function would be called to retrieve the malicious page name, which is then rendered by the JSP, causing the script to execute in the victim's browser. Therefore, this function would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.