← Back

CVE-2025-43740

nvd nist
Published: Aug 19, 2025Modified: Dec 19, 2025

JSON object

Loading...
4.6
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@liferay.com (Secondary)

Description

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Affected (7)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
From 2024.Q1.9 to 2024.Q1.20
Digital Experience Platform
From 2024.Q2.1 to 2024.Q2.13
Digital Experience Platform
From 2024.q3.1 to 2024.q3.13
Digital Experience Platform
From 2024.q4.0 to 2024.q4.7
Digital Experience Platform
From 2025.Q1.0 to 2025.Q1.16
Digital Experience Platform
From 2025.Q2.0 to 2025.Q2.9
Liferay Portal
From 7.4.3.120 to 7.4.3.132

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security@liferay.com
Vendor Advisory

Timeline

No history available yet.