> CVE-2025-43785

« BACK_TO_HOME
PUBLISHED
2025-09-10 17:15
MODIFIED
2025-09-11 17:14
EPSS (Prob. Exploit)
0.22%
Top 87.6%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-66x6-8jgv-qpfh MODERATE

Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

AFFECTED PACKAGES:
MAVEN / com.liferay:com.liferay.portal.workflow.task.web
< 5.0.75
Fixed in: 5.0.75
MAVEN / com.liferay.portal:release.dxp.bom
>= 7.4.13.u14, <= 7.4.13.u92
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.Q1.1, <= 2024.Q1.12
Fixed in: 2024.Q1.13
MAVEN / com.liferay.portal:release.dxp.bom
>= 2024.Q2.0, <= 2024.Q2.13
Fixed in: 2024.Q3.0
MAVEN / com.liferay.portal:release.portal.bom
>= 7.4.3.45, < 7.4.3.129
Fixed in: 7.4.3.129

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
GHSA-66x6-8jgv-qpfh

> HISTORIQUE DES MODIFICATIONS

Première apparition
10/09/2025 17:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME