N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43787

CVE-2025-43787: Liferay Portal's selection modal is vulnerable to XSS

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious payload is stored and executed without proper sanitization or escaping.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43787

CVE-2025-43787:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.users.admin.web	maven	>= 6.0.6, < 11.0.33	11.0.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Liferay Portal's user sites administration page. The provided patch b230afddd5125dc5f858d68011ef93e9c47703a6 clearly shows the fix in the modules/apps/users-admin/users-admin-web/src/main/resources/META-INF/resources/user/sites.jsp file.

The vulnerability lies in a JavaScript code block within this JSP file. Specifically, the groupdescriptivename of a selected site was being assigned to the entityName variable and then used to create a UI label without any sanitization. This allows an attacker with privileges to create or edit organization site names to inject a malicious script. When another user (e.g., an administrator) manages user sites and selects the maliciously crafted site, the script would execute in their browser.

The patch addresses this by wrapping the selectedItem.groupdescriptivename in an A.Escape.html() call, which properly escapes the HTML and prevents the script from being executed.

Since the vulnerability is within a JSP file, a Java profiler would trace the execution to the servlet generated from this JSP. The standard naming convention for JSPs compiled by Jasper (Tomcat's JSP engine) creates a class name based on the file path, and the main method that handles the request is _jspService. Therefore, org.apache.jsp.user.sites_jsp._jspService is the most precise representation of the vulnerable component that would appear in a Java runtime profile.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.