Executive Summary

CVE-2025-43794 is a stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP. It allows remote authenticated attackers who have the instance administrator role to inject arbitrary web scripts or HTML into all pages. This injection happens through a crafted payload submitted via the Instance Configuration's CDN Host HTTP or CDN Host HTTPS text fields. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with instance administrator privileges to inject malicious scripts or HTML into web pages, potentially leading to unauthorized actions performed in the context of other users, session hijacking, or defacement of the website. Although the CVSS score is moderate (4.6), the impact includes the risk of executing arbitrary scripts which can compromise user trust and site integrity. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking if the Instance Configuration's CDN Host HTTP or HTTPS text fields contain suspicious or crafted payloads that could inject scripts or HTML. Since the vulnerability requires authenticated access with instance administrator privileges, you can audit these configuration fields for unexpected script tags or HTML content. There are no specific commands provided in the resources for detection. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading affected Liferay Portal or DXP instances to fixed versions: Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, 2023.Q4.1, 2023.Q3.5, or 7.3 U36. Additionally, restrict instance administrator access to trusted users only and audit the CDN Host HTTP and HTTPS fields for malicious content to remove any injected scripts or HTML. [1]

Useful 0 Not Useful 0