PT-2025-34503 · Liferay · Liferay Portal+1

Milcert At · Published 2025-08-23 · Updated 2025-08-23 · CVE-2025-43769

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.8

Description: A stored cross-site scripting (XSS) vulnerability exists that allows remote attackers to execute arbitrary web script or HTML via the components tab.

Recommendations: Update Liferay Portal to a version later than 7.4.3.131. Update Liferay DXP to a version later than 2024.Q1.12. Update Liferay DXP to a version later than 2024.Q2.13. Update Liferay DXP to a version later than 2024.Q3.8.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-43769

GHSA-RVMF-JW8G-R35R

Affected Products

Liferay Dxp

Liferay Portal

References · 10

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43769 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43769 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvmf-jw8g-r35r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43769 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/0249230a00a8ab42a5edaf6bca1bcf594525c0e9 · Note
• https://t.me/CVEtracker/30753 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-18128 · Note
• https://twitter.com/CVEnew/status/1959114293775122923 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1959203264227864585 · Twitter Post