CVE-2025-43781

Liferay / Portal PUBLISHED

Description (CNA)

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet

Affected (CNA)

Vendor / product	Versions
Liferay / Portal	affected 7.4.3.110 through 7.4.3.128
Liferay / DXP	affected 2024.Q1.1 through 2024.Q1.12; affected 2024.Q2.0 through 2023.Q2.13; affected 2024.Q3.0 through 2024.Q3.8

CWE

CWE-79

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43781

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.