Liferay Portal CVE-2025-43771

Requires an authenticated Liferay account able to edit its own profile ('First Name', 'Middle Name', 'Last Name' fields) or to flag content (the 'Other Reason' text field or the flagged-content name). The injected payload is stored and only executes when another user - typically a moderator or administrator - views the entry in the Notifications widget, so success depends on that victim rendering the notification (UI:A). Limiting factors: a valid low-privileged account is required (PR:L, so this is most dangerous where untrusted self-registration is enabled), victim interaction is mandatory, and only the specified Portal/DXP build ranges are affected. Impact is bounded to low confidentiality and integrity within the web context, with no scope change to other systems.

This is a moderate, low-priority stored XSS issue rather than an urgent threat. The CVSS 4.0 base score is 4.8 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N: network-reachable and low-complexity, but it requires an authenticated account (PR:L) and active victim interaction (UI:A), and impact is limited to low confidentiality and low integrity with no availability impact and no scope/subsequent-system effect. Exploitation signals are weak and consistent with each other: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code was identified - so this is 'no public exploit identified at time of analysis.' No signals conflict. The combination of required authentication, required user interaction, and only low C/I impact means this is a classic high-volume-but-low-real-risk web flaw: worth patching in routine maintenance cycles, not an emergency. The one caveat is that stored XSS reaching an administrator viewing the Notifications widget could escalate practical impact (session/CSRF-style actions), so prioritization should rise for internet-facing portals with untrusted self-registration enabled.

An attacker with a low-privileged Liferay account sets a crafted script payload as their First/Middle/Last name (or submits it via the 'Other Reason' field or flagged-content name when flagging content). When a moderator or administrator later views the resulting entry in the Notifications widget, the stored script executes in the victim's authenticated browser session. No public exploit code is known, and exploitation requires both an authenticated account (PR:L) and the victim actively viewing the notification (UI:A).