PT-2025-33744

CVE-2025-43738

·

Published

2025-08-19

·

Updated

2025-12-15

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2024.Q1.1 through 2024.Q1.19 Liferay DXP versions 2024.Q2.1 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2025.Q1.0 through 2025.Q1.15 Liferay DXP versions 2025.Q2.0 through 2025.Q2.8
Description: A reflected cross-site scripting (XSS) vulnerability allows a remote authenticated user to inject JavaScript code via the com liferay expando web portlet ExpandoPortlet displayType parameter.
Recommendations: Liferay Portal versions prior to 7.4.3.133 Liferay DXP versions prior to 2024.Q1.1 Liferay DXP versions prior to 2024.Q2.1 Liferay DXP versions prior to 2024.Q3.1 Liferay DXP versions prior to 2024.Q4.1 Liferay DXP versions prior to 2025.Q1.0 Liferay DXP versions prior to 2025.Q2.0
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-43738
GHSA-CWGH-R52J-XH6C
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com