CVE-2025-43802 — Cross-site Scripting in Digital Experience Platform

CWE-79 — Cross-site ScriptingCWE-122 — Heap-based Buffer Overflow5 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 90.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedSep 15
Latest updateSep 16

Description

Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDliferay/liferay_portal7.4.3.51 — 7.4.3.110
▶CVEListV5liferay/portal7.4.3.51 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.5+2
▶CVEListV5liferay/dxp7.3.10-u33 — 7.3.10-u35+3

🔴Vulnerability Details

3
OSV
Liferay Stored Cross-site Scripting vulnerability↗2025-09-16
▶
GHSA
Liferay Stored Cross-site Scripting vulnerability↗2025-09-16
▶
CVEList
CVE-2025-43802: Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7↗2025-09-15
▶

📋Vendor Advisories

1
Microsoft
heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697↗2024-08-13
▶
CVE-2025-43802 — Cross-site Scripting | cvebase