N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43778

CVE-2025-43778: Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43778

CVE-2025-43778:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.workflow.kaleo.forms.web	maven	>= 5.0.3, < 5.0.107	5.0.107

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit a540e050d0d939218cfb90b1e5b6c21244a834cb clearly indicates a stored cross-site scripting (XSS) vulnerability in Liferay Portal's Kaleo Forms Admin. The vulnerability is located in the fields.jsp file.

The patch shows that the output of structure.getName(locale) was being directly embedded into a JSON object that is later rendered on the page. The lack of output encoding for this user-controllable value (the fieldset name) is the root cause of the vulnerability. An authenticated attacker could craft a fieldset with a name containing a JavaScript payload (e.g., <script>alert(1)</script>). When this fieldset name is rendered in the Kaleo Forms Admin UI, the script would execute in the context of the victim's browser.

The fix involves wrapping the call to structure.getName(locale) with HtmlUtil.escapeAttribute(). This function sanitizes the string, preventing any embedded scripts from being executed.

Since the vulnerability is within a JSP file, the function that would appear in a runtime profile is the service method of the compiled JSP servlet. For the file admin/process/fields.jsp, the Java servlet container would typically generate a class named org.apache.jsp.admin.process.fields_jsp with a _jspService method containing the JSP's logic. Therefore, this is the most precise function signature that would be observed during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.