N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43738

CVE-2025-43738: Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via _com_liferay_expando_web_portlet_ExpandoPortlet_displayType parameter.

Liferay Portal is fixed on the master branch from commit acc4771.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43738

CVE-2025-43738:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.expando.web	maven	<= 5.0.59

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of this vulnerability started with the provided commit acc477143b50de2138854548bc5bad06677e708a. The commit shows a change in the JSP file modules/apps/expando/expando-web/src/main/resources/META-INF/resources/edit/expando.jsp, where HtmlUtil.escape is added to sanitize the output of LanguageUtil.format. The variable being escaped is propertyDisplayType, which is derived from the displayType request parameter mentioned in the vulnerability description.

The root cause of the vulnerability is a reflected Cross-Site Scripting (XSS) issue. The displayType parameter is not sanitized before being rendered in the HTML response, allowing an attacker to inject arbitrary JavaScript.

Based on this, two vulnerable functions were identified:

org.apache.jsp.edit.expando_jsp._jspService: This is the most direct location of the vulnerability. JSP files are compiled into Java Servlets, and the _jspService method contains the code from the JSP. The unescaped rendering of the propertyDisplayType parameter happens within this method. This function would certainly appear in a runtime profile during exploitation.
com.liferay.expando.web.portlet.ExpandoPortlet.render: The vulnerability description points to the ExpandoPortlet via the namespaced parameter _com_liferay_expando_web_portlet_ExpandoPortlet_displayType. In a typical Liferay MVC architecture, the portlet's render method is the entry point that handles the request and forwards it to the JSP for rendering. Therefore, this function is the starting point of the vulnerable code path and would also be present in a stack trace during exploitation.

By identifying both the entry point in the application logic (ExpandoPortlet.render) and the exact location of the vulnerable code execution (_jspService of the compiled JSP), we get a comprehensive view of the functions involved in this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.