N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43755

CVE-2025-43755: Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43755

CVE-2025-43755:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.layout.admin.web	maven	< 5.0.191	5.0.191

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored cross-site scripting (XSS) issue within the Liferay Portal's layout administration functionality. The root cause is the failure to properly sanitize user-provided input for the 'type' parameter of a page layout before it is rendered back to the user in the administration interface.

The analysis of the provided patches pinpoints the exact locations of the vulnerability. The commit 5db1ab018d71689fc1eaebcbd27c202e9c2b44d9 clearly shows the remediation. In two JSP files, general.jsp and layout_type_resources.jsp, the type variable, which holds the value of the vulnerable parameter, was being directly embedded into the HTML output within <liferay-ui:message> tags. This would cause any malicious script injected into the 'type' parameter to be executed in the browser of an administrator viewing the page configuration.

The fix involves wrapping the type variable with HtmlUtil.escape(), a standard Liferay utility function for HTML escaping, which neutralizes the malicious script by converting special HTML characters into their entity equivalents. The second commit, f91c374d28c478db38006f5c2d1802c2ab55d034, adds a Playwright test that confirms the vulnerability by attempting to inject a script and verifying that it does not execute.

Since the vulnerabilities lie within JSP files, which are server-side templates that get compiled into servlets, the vulnerable 'functions' are the JSP files themselves. During runtime, a profiler would trace the execution to the compiled servlet classes corresponding to these JSPs. Therefore, identifying these JSP files is the most accurate way to pinpoint the vulnerable code locations from the provided information.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.