CVE-2025-43783 - Vulnerability Details

Description

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

Published: 2025-09-10

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Liferay

Portal

unaffected

Version	Status	Constraints
`7.4.3.73`	affected	≤ 7.4.3.128

Liferay

DXP

unaffected

Version	Status	Constraints
`7.4.13-u73`	affected	≤ 7.4.13-u92
`2024.Q1.1`	affected	≤ 2024.Q1.12
`2024.Q2.0`	affected	≤ 2024.Q2.13
`2024.Q3.0`	affected	≤ 2024.Q3.1

Configuration 1 [-]

OR	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform::::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update73::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update74::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update75::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update76::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update77::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update78::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update79::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update80::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update81::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update82::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update83::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update84::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update85::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update86::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update87::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update88::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update89::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update90::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update91::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update92::::::
	cpe:2.3:a:liferay:liferay_portal::::::::

No data.

Vendor	Product	Confidence	Versions
Liferay	Dxp	—	—
Liferay	Portal	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2025-27611	Liferay Portal is vulnerable to Reflected XSS attack through get_editor path
Github GHSA	GHSA-jhgr-j9cj-8j62	Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783

History

Tue, 16 Dec 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Liferay digital Experience Platform Liferay liferay Portal
CPEs		cpe:2.3:a:liferay:digital_experience_platform:::::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:::::: cpe:2.3:a:liferay:liferay_portal::::::::
Vendors & Products		Liferay digital Experience Platform Liferay liferay Portal
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Thu, 11 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Liferay Liferay dxp Liferay portal
Vendors & Products		Liferay Liferay dxp Liferay portal

Wed, 10 Sep 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Sep 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.
Weaknesses		CWE-79
References		https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Liferay Digital Experience Platform Dxp Liferay Portal Portal

MITRE

Status: PUBLISHED

Assigner: Liferay

Published: 2025-09-10T20:03:33.594Z

Updated: 2025-09-10T20:14:54.925Z

Reserved: 2025-04-17T10:55:29.974Z

Link: CVE-2025-43783

Vulnrichment

Updated: 2025-09-10T20:14:51.353Z

NVD

Status : Analyzed

Published: 2025-09-10T20:15:33.977

Modified: 2025-12-16T14:45:55.890

Link: CVE-2025-43783

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-09-11T10:42:39Z

Weaknesses

CWE-79

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object