{"id":"CVE-2025-43774","aliases":["EUVD-2025-27257","GHSA-qgj5-4qvg-2f8c"],"status":"rejected","title":"Liferay Portal is vulnerable to XSS attack through its Style Book theme","description":"This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-09-09T00:26:08Z","modified":"2025-09-18T17:15:38Z","fixes":[{"ecosystem":"Maven","package":"com.liferay:com.liferay.frontend.taglib.clay","fixed_in":["15.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.liferay:com.liferay.frontend.taglib.clay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.liferay:com.liferay.frontend.taglib.clay","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3.0","1.3.1","1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.23","1.4.24","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","10.0.0","11.0.0","11.0.1","11.1.0","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.1.0","12.1.1","12.1.10","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8","12.1.9","13.0.0","13.0.1","13.0.2","13.0.3","13.0.4","13.1.0","13.1.1","13.10.0","13.10.1","13.11.0","13.11.1","13.12.0","13.13.0","13.13.1","13.2.0","13.3.0","13.4.0","13.4.1","13.4.2","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.5.5","13.5.6","13.6.0","13.6.1","13.6.2","13.6.3","13.7.0","13.8.0","13.9.0","13.9.1","14.0.0","14.1.0","14.1.1","14.1.2","14.1.3","14.1.4","14.1.5","14.2.0","14.2.1","14.3.0","14.3.1","14.3.2","14.4.0","15.0.0","15.0.1","15.0.2","15.0.3","15.0.4","15.0.5","15.0.6","15.0.7","15.0.8","15.0.9","15.1.0","15.1.1","15.1.2","15.1.3","15.1.4","15.1.5","15.2.0","2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.29","2.2.3","2.2.30","2.2.31","2.2.32","2.2.33","2.2.34","2.2.35","2.2.36","2.2.37","2.2.38","2.2.39","2.2.4","2.2.40","2.2.41","2.2.42","2.2.43","2.2.44","2.2.45","2.2.46","2.2.47","2.2.48","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.3.0","3.3.1","3.4.0","3.4.1","3.4.2","3.5.0","4.0.0","4.0.1","4.0.2","4.0.3","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.1.0","6.1.1","6.1.2","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.3.0","6.3.1","6.3.10","6.3.11","6.3.12","6.3.13","6.3.14","6.3.15","6.3.16","6.3.17","6.3.18","6.3.19","6.3.2","6.3.20","6.3.21","6.3.22","6.3.3","6.3.4","6.3.5","6.3.6","6.3.7","6.3.8","6.3.9","6.4.0","6.4.1","6.4.10","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","6.4.9","6.5.0","6.5.1","6.6.0","6.6.1","6.6.10","6.6.11","6.6.12","6.6.13","6.6.14","6.6.15","6.6.16","6.6.17","6.6.18","6.6.19","6.6.2","6.6.20","6.6.21","6.6.22","6.6.23","6.6.24","6.6.25","6.6.26","6.6.3","6.6.4","6.6.5","6.6.6","6.6.7","6.6.8","6.6.9","7.1.0","7.1.1","7.1.10","7.1.11","7.1.12","7.1.13","7.1.14","7.1.2","7.1.3","7.1.4","7.1.5","7.1.6","7.1.7","7.1.8","7.1.9","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.3.3","7.3.4","7.4.0","7.4.1","7.4.2","7.4.3","7.4.4","7.5.0","7.5.1","8.0.0","8.0.1","8.0.2","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.1.0","9.1.1","9.1.10","9.1.11","9.1.12","9.1.13","9.1.14","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.1","9.2.10","9.2.11","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.1"]}],"products":[{"vendor":"liferay","product":"dxp"},{"vendor":"liferay","product":"portal"}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43774","tags":["advisory"]},{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43774","tags":["web"]},{"url":"https://github.com/liferay/liferay-portal/commit/e15df92e3faa3abbf38e3643b79ab8cf2983d6df","tags":["web"]},{"url":"https://liferay.atlassian.net/browse/LPE-18222","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qgj5-4qvg-2f8c"},{"url":"https://github.com/liferay/liferay-portal","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-43774","description":"This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.","status":"rejected","published":"2025-09-09T00:26:08.205Z","modified":"2025-09-18T16:46:08.85Z","updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-27257","description":"This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.","status":"published","published":"2025-09-09T00:26:08Z","modified":"2025-09-18T16:46:08Z","cvss":[{"version":"","score":0,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"none"}],"updated_at":"2026-11-02T20:31:41.781446Z"}],"ghsa":[{"id":"GHSA-qgj5-4qvg-2f8c","title":"Liferay Portal is vulnerable to XSS attack through its Style Book theme","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.","status":"published","published":"2025-09-09T03:30:17Z","modified":"2025-09-10T20:01:57Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-43774","description":"Rejected reason: This CVE ID is rejected. The reported vulnerability was found to be present only in a feature that was under development and protected by a beta feature flag. As a result, the issue was not exploitable in the official or public releases within the specified affected ranges, making this a false positive for officially released versions.","status":"rejected","published":"2025-09-09T01:15:31.967Z","modified":"2025-09-18T17:15:38.66Z","updated_at":"2026-11-02T14:11:27.73916Z"}],"osv":[{"id":"GHSA-qgj5-4qvg-2f8c","title":"Liferay Portal is vulnerable to XSS attack through its Style Book theme","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.17 allows a remote authenticated user to inject JavaScript code via Style Book theme name. This malicious payload is then reflected and executed within the user's browser.","status":"published","published":"2025-09-09T03:30:17Z","modified":"2025-09-10T20:42:54.867935Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}