N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43800

CVE-2025-43800: Liferay Portal Cross-site Scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43800

CVE-2025-43800:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.dynamic.data.mapping.form.field.type	maven	< 6.0.167	6.0.167

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of output sanitization for rich text fields in Liferay's Dynamic Data Mapping framework. When a user inputs content into a rich text field, the backend stores this as an HTML string. The vulnerability is triggered when this stored HTML is rendered back to a user without being properly sanitized. This allows an attacker to inject malicious <script> tags or other HTML attributes that can execute JavaScript in the victim's browser.

The identified vulnerable function, com.liferay.dynamic.data.mapping.form.field.type.internal.renderer.RichTextDDMFormFieldRenderer.render, is the component responsible for this rendering process. During an exploit, a profiler would show this function being called as part of the page rendering process where the malicious rich text content is displayed. The fix for this vulnerability would involve modifying this function to use a sanitizer, such as Liferay's HtmlUtil.escape(), on the rich text content before it is written to the HTTP response. Although the exact commit was not found, the combination of the vulnerability description, the affected package, and the typical architecture of Liferay's DDM framework provides high confidence in this identification.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.