← Back

CVE-2025-43731

nvd nist
Published: Aug 18, 2025Modified: Dec 19, 2025

JSON object

Loading...
6.9
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@liferay.com (Secondary)

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

Affected (7)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
From 2024.Q1.1 to 2024.Q1.17
Digital Experience Platform
From 2024.q2.0 to 2024.q2.13
Digital Experience Platform
From 2024.q3.1 to 2024.q3.13
Digital Experience Platform
From 2024.q4.0 to 2024.q4.7
Digital Experience Platform
From 2025.Q1.0 to 2025.Q1.9
Digital Experience Platform
Version 7.4
Liferay Portal
From 7.4.0 to 7.4.3.132

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security@liferay.com
Vendor Advisory

Timeline

No history available yet.