CVE-2025-43731: XSS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43731?
CVE-2025-43731 is classified as a reflected cross-site scripting (XSS) vulnerability.
Which versions of Liferay are affected by CVE-2025-43731?
CVE-2025-43731 affects Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.8, along with several other specific version ranges.
How do I fix CVE-2025-43731?
To fix CVE-2025-43731, you should upgrade to the latest patched version of Liferay Portal or Liferay DXP as outlined by the vendor.
What types of attacks can be carried out using CVE-2025-43731?
CVE-2025-43731 can be exploited by attackers to execute arbitrary JavaScript in the context of the user's browser.
Is CVE-2025-43731 easy to exploit?
Yes, CVE-2025-43731 is considered to be relatively easy to exploit if the affected software is publicly accessible.