TI-2025-28366 Aliases CVE-2025-43779 GHSA-687m-mwvq-fx42

Cross-site scripting in Liferay Portal

LOW 36CWE-79Published 2025-09-24 · Updated 2025-09-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsPortlet_productTypeName parameter. This malicious payload is then reflected and executed within the user's browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00232 14th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Liferay	Portal	7.4.0 – 7.4.3.112	—	No fix listed	CNA
Liferay	DXP	7.4.13 – 7.4.13-u92; 2024.Q1.1 – 2024.Q1.18	—	No fix listed	CNA

Portal VendorLiferay Affected 7.4.0 – 7.4.3.112 Fixed in — No fix listed CNA
DXP VendorLiferay Affected 7.4.13 – 7.4.13-u92; 2024.Q1.1 – 2024.Q1.18 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:liferay:digital_experience_platform::::::::	2024.Q1.1 to before 2024.Q1.19	Vulnerable	Liferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:::::::*	7.4	Vulnerable	Liferay
cpe:2.3:a:liferay:liferay_portal::::::::	7.4.0 to before 7.4.3.113	Vulnerable	Liferay

cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* Versions 2024.Q1.1 to before 2024.Q1.19 Vulnerable ·Liferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Liferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.0 to before 7.4.3.113 Vulnerable ·Liferay

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-43779
2026-10-03 Alias added: GHSA-687m-mwvq-fx42

References

Advisory 1

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43779

TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6

See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences