Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

🗓️ 12 Aug 2025 21:31:20Reported by GitHub Advisory DatabaseType

Reflected XSS in Liferay Portal 7.4.x and Liferay DXP; remote authenticated attacker injects JS via the first display label in a custom sort widget; clay button taglib on refresh.

Reporter	Title	Published	Views	Family All 12
CNNVD	Liferay Portal和Liferay DXP 跨站脚本漏洞	12 Aug 202500:00	–	cnnvd
CVE	CVE-2025-43734	12 Aug 202518:51	–	cve
Cvelist	CVE-2025-43734	12 Aug 202518:51	–	cvelist
EUVD	EUVD-2025-24463	3 Oct 202520:07	–	euvd
NVD	CVE-2025-43734	12 Aug 202519:15	–	nvd
OSV	CVE-2025-43734	12 Aug 202519:15	–	osv
OSV	GHSA-M5C7-5GV3-HCPF Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability	12 Aug 202521:31	–	osv
Positive Technologies	PT-2025-32880 · Liferay · Liferay Dxp +1	12 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-43734	14 Aug 202519:30	–	redhatcve
Snyk	Cross-site Scripting (XSS)	12 Aug 202521:31	–	snyk

Vulners

Node

com.liferay com.liferay.frontend.taglib.clayRange<15.2.2maven

com.liferay.portal release.dxp.bomRange≤7.4.13.u92maven

com.liferay.portal release.dxp.bomRange2025.q1.0–2025.q1.10maven

com.liferay.portal release.dxp.bomRange2024.q1.0–2024.q1.16maven

com.liferay.portal release.dxp.bomRange2024.q2.0–2024.q2.13maven

com.liferay.portal release.dxp.bomRange2024.q3.0–2024.q3.13maven

com.liferay.portal release.dxp.bomRange2024.q4.0–2024.q4.7maven

com.liferay.portal release.portal.bomRange7.4.0–7.4.3.132maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-43734
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43734
github	www.github.com/liferay/liferay-portal/commit/b4ca1bb0961cc1f230508e072c30815eabce062f
liferay	www.liferay.atlassian.net/browse/LPE-18234
github	www.github.com/advisories/GHSA-m5c7-5gv3-hcpf

14 Aug 2025 15:54Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.4

CVSS 45.1

EPSS0.00048

SSVC

CWE-79