N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43744

CVE-2025-43744: Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43744

CVE-2025-43744:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.0-ga1, <= 7.4.3.132-ga132

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Liferay Portal, originating from the handling of Dynamic Data Mapping (DDM) structure field labels. The analysis of the provided patches pinpoints the exact locations in the backend code where the vulnerability was addressed.

The root cause is the failure to sanitize user-provided labels for DDM structure fields. An attacker can create a data structure with a field label containing malicious JavaScript. When this structure is processed by the system, the script is stored.

The investigation of the commits reveals two key vulnerable functions:

com.liferay.asset.model.DDMStructureClassType.getClassTypeFields: This method is responsible for reading the DDM structure definitions. The patch c07a490b3d3759f38c5473cda74e99540bd0235e clearly shows that the label was being read directly and was later escaped using HtmlUtil.escape(). This indicates that this function was a source of unsanitized data, creating ClassTypeField objects with potentially malicious labels.
com.liferay.journal.internal.util.JournalDefaultTemplateProviderImpl._addDDMStructureFields: This method consumes the data from DDM structures to generate default template content. The same patch shows that it was appending the raw label to an HTML string (StringBuilder). This is a sink for the vulnerability, where the unsanitized data is used to construct a web page, leading to XSS when the page is rendered in a user's browser. The fix involves escaping the label before it's appended.

The vulnerability description mentions the Source.js module in the Asset Publisher configuration UI, which is the client-side component. The identified Java functions are the server-side source of the vulnerable data that is sent to this JavaScript module. By fixing the issue on the backend, the malicious script is neutralized before it can reach the client-side code, thus preventing the innerHTML injection described.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.