N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43740

CVE-2025-43740: Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Liferay Portal is fixed on the master branch from commit c1b7c6b.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43740

CVE-2025-43740:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.3.120-ga120, <= 7.4.3.132-ga23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a stored Cross-Site Scripting (XSS) issue in the Message Boards feature of Liferay Portal. The root cause is not a flaw in a single function but a logical error in the composition of multiple data sanitization components.

The system uses a chain of 'sanitizer' classes to clean user input, orchestrated by the SanitizerUtil.sanitize method. The vulnerability arises because, prior to the patch, these sanitizers were executed in a non-deterministic order. One of the sanitizers, IFrameSanitizerImpl, is designed to un-escape HTML entities. When this sanitizer ran after other security sanitizers (like AntiSamySanitizerImpl) had already escaped malicious input (e.g., converting <script> to <script>), it would reverse the escaping, re-introducing the active XSS payload into the content before it was stored and displayed to other users.

The fix involves introducing a deterministic execution order for the sanitizers by adding a sanitizer.order property to each one and updating SanitizerUtil to respect this order. This ensures that the un-escaping step happens at the correct point in the process, preventing it from negating the effects of the other security filters. Any runtime profile capturing the exploitation of this CVE would show calls to SanitizerUtil.sanitize, which in turn would call the sanitize methods of the various sanitizer implementations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.