CVE-2025-43735: XSS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the googlegadget.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43735?
CVE-2025-43735 is classified as a reflected cross-site scripting (XSS) vulnerability, which can lead to significant security risks for affected systems.
How do I fix CVE-2025-43735?
To fix CVE-2025-43735, upgrade Liferay Portal to version 7.4.4 and above or Liferay DXP to the latest versions specified in the security advisory.
Which versions are affected by CVE-2025-43735?
CVE-2025-43735 affects Liferay Portal versions 7.4.0 to 7.4.3.131 and Liferay DXP versions across several quarterly updates listed in the advisory.
Can CVE-2025-43735 be exploited remotely?
Yes, CVE-2025-43735 can be exploited remotely by unauthenticated attackers through crafted URLs.
Is user authentication required to exploit CVE-2025-43735?
No, CVE-2025-43735 can be exploited by remote non-authenticated users without any required authentication.