PT-2025-34144

CVE-2025-43746

·

Published

2025-08-20

·

Updated

2025-12-12

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2024.Q1.1 through 2024.Q1.18 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2025.Q1.0 through 2025.Q1.10 Liferay DXP versions 2025.Q2.0 through 2025.Q2.2 Liferay Portal 7.4 GA through update 92
Description: This issue is a reflected cross-site scripting (XSS) vulnerability. A remote authenticated attacker can inject JavaScript code through the com liferay dynamic data mapping web portlet DDMPortlet portletNamespace and com liferay dynamic data mapping web portlet DDMPortlet namespace parameters.
Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.132: Update to a newer version. Liferay DXP versions 2024.Q1.1 through 2024.Q1.18: Update to a newer version. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: Update to a newer version. Liferay DXP versions 2024.Q3.0 through 2024.Q3.13: Update to a newer version. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: Update to a newer version. Liferay DXP versions 2025.Q1.0 through 2025.Q1.10: Update to a newer version. Liferay DXP versions 2025.Q2.0 through 2025.Q2.2: Update to a newer version. Liferay Portal 7.4 GA through update 92: Update to a newer version.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-43746
GHSA-MPWW-R37C-VXJW
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com