> CVE-2025-43735

« BACK_TO_HOME
PUBLISHED
2025-08-12 13:15
MODIFIED
2025-08-12 14:25
EPSS (Prob. Exploit)
0.22%
Top 88.3%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-01

> DESCRIPTION

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-222w-xmc5-jhp3 MODERATE

Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

AFFECTED PACKAGES:
MAVEN / com.liferay.portal:com.liferay.portal.impl
>= 7.0.4, < 109.1.0
Fixed in: 109.1.0
MAVEN / com.liferay.portal:release.dxp.bom
<= 7.4.13.u92
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.q1.0, < 2024.q1.13
Fixed in: 2024.q1.13
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.q2.0, <= 2024.q2.13
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.q3.0, <= 2024.q3.13
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.q4.0, <= 2024.q4.7
MAVEN / com.liferay.portal:release.portal.bom
>= 7.4.0, <= 7.4.3.131
Fixed in: 7.4.3.132

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
10 versions affected
ALIASES:
GHSA-222w-xmc5-jhp3

> HISTORIQUE DES MODIFICATIONS

Première apparition
12/08/2025 13:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:07
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME