PT-2025-32669 · Liferay · Liferay Portal+1

Shailesh Suthar · Publicado 2025-08-12 · Atualizado 2025-08-12 · CVE-2025-43735

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay Portal 7.4 GA through update 92

Description: A reflected cross-site scripting (XSS) vulnerability exists that allows a remote, non-authenticated attacker to inject JavaScript into the google gadget.

Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.131 should be updated. Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 should be updated. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 should be updated. Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 should be updated. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 should be updated. Liferay Portal 7.4 GA through update 92 should be updated.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-43735

GHSA-222W-XMC5-JHP3

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 11

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/64d19e457ffc9876fd159a907741618843d7aadb · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-43735 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1955334630552293735 · Publicação no Twitter
• https://t.me/CVEtracker/29787 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1955245686129299735 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-43735 · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43735 · Aviso do Fabricante
• https://t.me/cveNotify/131795 · Publicação no Telegram
• https://liferay.atlassian.net/browse/LPE-18158 · Nota
• https://osv.dev/vulnerability/GHSA-222w-xmc5-jhp3 · Aviso do Fabricante