CVE-2025-43776

The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size of files it combines. A remote attacker can craft URL query strings to generate very large responses, leading to a denial of service attack.

Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions, are vulnerable to self-XSS on the edit Knowledge Base article page. A remote attacker can inject arbitrary script or HTML via a crafted payload in an attachment's filename.

Missing authorization in the Collection Provider component of Liferay Portal and Liferay DXP. Instance users can read and select unauthorized Blueprints across instances.

A reflected cross-site scripting (XSS) vulnerability, caused by a regression, was identified in Liferay Portal and Liferay DXP. A remote authenticated attacker can inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter, and the malicious payload executes in the victim's browser when they access a crafted URL.

The Menu Display Widget in Liferay Portal and Liferay DXP shows content to users who lack permission to view it. This could expose sensitive information to unauthorized users.

An IDOR vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

An insecure direct object reference (IDOR) and improper permission check vulnerability exists in Publications in Liferay Portal and Liferay DXP. A remote authenticated attacker can view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter and edit comments via crafted URLs.

An insecure direct object reference (IDOR) vulnerability exists in the Publications module of Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. A remote authenticated attacker can view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.

Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.

A cross-site scripting (XSS) vulnerability in the workflow process builder in Liferay Portal and Liferay DXP allows remote authenticated attackers to inject arbitrary web script or HTML via crafted input in a workflow definition.