CVE-2025-43744 Security Details

CVE ID

CVE-2025-43744

CWE

CWE-79

CVE Description

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.

Published

Aug 20, 2025

CVSS Score & Severity

5.4Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

0.050%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/liferay/asset/kernel/model/DDMStructureClassType.getClassTypeFields(J)Ljava/util/List;

JVMVulnerable params: 0

com/liferay/asset/model/DDMStructureClassType.getClassTypeFields(J)Ljava/util/List;

JVMVulnerable params: 0

com/liferay/journal/internal/util/JournalDefaultTemplateProviderImpl.getScript(J)Ljava/lang/String;

JVMVulnerable params: 0

com/liferay/journal/util/impl/JournalDefaultTemplateProviderImpl.getScript(J)Ljava/lang/String;

JVMVulnerable params: 0

com/liferay/portlet/asset/model/BaseAssetRendererFactory.getDDMStructureFieldNames(Lcom/liferay/portlet/dynamicdatamapping/model/DDMStructure;Ljava/util/Locale;)Ljava/util/List;

JVMVulnerable params: 1

com/liferay/portlet/asset/model/DDMStructureClassType.getClassTypeFields(I)Ljava/util/List;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · CommitPROJECT

liferay.devPROJECT

GitHub · Advisory · GHSA-m49p-6cjp-x2h3THIRD_PARTY