N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43822

CVE-2025-43822: Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Condition's Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43822

CVE-2025-43822:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.3.15, < 7.4.3.112-ga112	7.4.3.112-ga112

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Liferay Portal's "View Order" page. The root cause is the improper neutralization of user-supplied input in the "Name" text field of a "Terms and Condition". This allows an attacker to inject malicious HTML and script code, which is then stored in the database and executed in the browser of any user who views the order.

The provided commits address this vulnerability by adding input sanitization to several components. The most relevant commit is 433f82c03fac10167f1f811efb482d6010bac6db, which explicitly adds sanitization to the CPDefinition model's fields. The test case testAvoidMaliciousCodeInCPDefinitionFields in CPDefinitionLocalServiceTest.java demonstrates how a malicious payload could have been injected and is now properly escaped.

Additionally, two other commits were identified that, while not directly related to the "View Order" page, also address XSS vulnerabilities by adding HtmlUtil.escape to user-controlled data. These are 4218ecd902dbd860d3f9ee233b0ffa4c822a49ee in the MentionsPortlet and bccc5472db10281b5bec569eb2a3f9ddfb4035ec in the RichTextDDMFormFieldValueRenderer. These commits indicate a broader pattern of insufficient input sanitization in the affected Liferay Portal versions.

By exploiting this vulnerability, an attacker could perform various malicious actions, such as stealing session cookies, redirecting users to phishing pages, or executing arbitrary code in the context of the user's session. The identified vulnerable functions are critical to understanding how this vulnerability could be triggered and how to detect exploitation attempts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.