Liferay DXP CVE-2025-43830

Exploitation requires that the target deployment uses the Liferay Forms feature and that a form includes a rich-text-type field into which the attacker can submit content; the payload is stored and only triggers when another user renders the submission in their browser (UI:A - victim interaction is mandatory). The vendor's PR:N rating assumes the affected form is reachable for submission without authentication (e.g., a publicly published form accepting anonymous input); where forms require authenticated access to submit, the practical barrier is higher. Limiting factors: requires the Forms module to be in use with a rich-text field, requires a victim to view the malicious submission, and impact is confined to the victim's browser session rather than the server.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Forms feature of Liferay Portal and DXP, rated by the vendor at CVSS 4.0 5.1 (Medium). The vendor's 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates network-reachable, low-complexity injection requiring no privileges but DOES require victim user interaction (UI:A), and impact is limited to low confidentiality and low integrity (VC:L/VI:L) with no availability impact - consistent with browser-context script execution rather than server compromise. EPSS is low at 0.24% (14th percentile), the vulnerability is NOT in the CISA KEV catalog, and no public exploit code was provided in the input, so there is no public exploit identified at time of analysis. All signals are internally consistent and point to a genuine but modest-priority issue: real and remotely injectable, but constrained by required victim interaction and a bounded (browser-side) impact - not a drop-everything critical. Note a nuance worth verifying: the vendor assigns PR:N (unauthenticated injection), which only holds if the targeted Liferay form is published for anonymous/public submission; for forms gated behind authentication the real-world privilege requirement is higher - verify the deployment's form exposure. No data is strongly conflicting, but POC status is simply absent rather than confirmed negative.

An attacker submits a crafted payload into a rich-text-type field of a Liferay form, persisting malicious script in the portal. When an administrator, reviewer, or another user later views the stored submission in their browser, the script executes in their session context, enabling session/cookie theft, UI defacement, or actions performed as the victim. No public exploit was identified, and exploitation depends on a victim viewing the poisoned content (UI:A).