CVE-2025-43733

published 2025-08-18

CVE-2025-43733: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated…

low 2.3 CVSS 4.0

AV N AC H AT N PR N UI P VC L VI L VA N SC L SI L SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	>= 2025.Q1.0 < 2025.Q1.8	2025.Q1.8
liferay	dxp	2025.Q1.0 – 2025.Q1.7	—
liferay	liferay_portal	—	—
liferay	portal	—	—

CWE-79