PT-2025-37736 · Liferay · Liferay Portal+1

Published

2025-09-15

·

Updated

2025-12-16

·

CVE-2025-43791

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 36
Description The software contains multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a crafted payload into a “Rich Text” type field. The injection points include web content structures, Documents and Media Document Types, and custom assets utilizing the Data Engine’s module Rich Text field.
Recommendations Liferay Portal versions 7.3.0 through 7.4.3.111: Update to a version later than 7.4.3.111. Liferay DXP versions 2023.Q3.1 through 2023.Q3.4: Update to a version later than 2023.Q3.4. Liferay DXP version 2023.Q4.0: Update to a newer version. Liferay Portal versions 7.4 GA through update 92: Update to a version later than update 92. Liferay Portal versions 7.3 GA through update 36: Update to a version later than update 36.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-43791
GHSA-5C6V-FQCW-W6Q5

Affected Products

Liferay Dxp
Liferay Portal