PT-2025-33648 · Liferay · Liferay Dxp 2025.Q1.7+2

Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-43733

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal version 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.7

Description: A reflected cross-site scripting (XSS) vulnerability allows a remote authenticated attacker to inject JavaScript code via the content page’s name field. This malicious payload is then reflected and executed within the user’s browser when viewing the "document View Usages" page.

Recommendations: Liferay Portal version 7.4.3.132: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2025.Q1.0 through 2025.Q1.7: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-43733

GHSA-VHCR-HGC8-29QR

Affected Products

Liferay Dxp 2025.Q1.0

Liferay Dxp 2025.Q1.7

Liferay Portal 7.4.3.132

References · 10

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43733 · Security Note
• https://osv.dev/vulnerability/GHSA-vhcr-hgc8-29qr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43733 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/2135a88adb8c7f1a6cb4fbd768fef3b08953a50c · Note
• https://twitter.com/CVEnew/status/1957431002512470099 · Twitter Post
• https://liferay.atlassian.net/browse/LPE-18218 · Note
• https://twitter.com/VulmonFeeds/status/1957434162182283488 · Twitter Post
• https://t.me/CVEtracker/30271 · Telegram Post