N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43785

CVE-2025-43785: Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43785

CVE-2025-43785:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.3.45, < 7.4.3.129	7.4.3.129
com.liferay.portal:release.dxp.bom	maven	>= 2024.Q2.0, <= 2024.Q2.13	2024.Q3.0
com.liferay.portal:release.dxp.bom	maven	>= 2024.Q1.1, <= 2024.Q1.12	2024.Q1.13
com.liferay.portal:release.dxp.bom	maven	>= 7.4.13.u14, <= 7.4.13.u92
com.liferay:com.liferay.portal.workflow.task.web	maven	< 5.0.75	5.0.75

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Liferay Portal's workflow task management. The root cause is the failure to properly sanitize user-provided data, specifically the user name associated with a workflow task, before it is rendered on the 'My Workflow Tasks' page.

The provided patch, commit 5f1a7c347c81f05848f032a9e25cbc9abaab05ff, clearly shows that the getUserName() method's return value was being directly embedded into the HTML of view.jsp. An attacker could create a user with a name containing a malicious script (e.g., <script>alert(1)</script>). When this user is involved in a workflow, their name is displayed on the 'My Workflow Tasks' page, and the script would execute in the browser of any user viewing that page.

The fix involves wrapping the output of workflowTask.getUserName() with HtmlUtil.escape(). This function neutralizes any embedded HTML or script tags by converting them into their corresponding HTML entities (e.g., < becomes <), thus preventing the browser from executing them.

The vulnerable function is identified as com.liferay.portal.workflow.task.web.internal.display.context.WorkflowTaskDisplayContext.getUserName because it is the source of the untrusted data that is rendered in the JSP. While the vulnerability manifests in the JSP file, the data originates from this method. A runtime profiler would show this method being called as part of the rendering process for the 'My Workflow Tasks' page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.