CVE-2025-43740: XSS
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43740?
CVE-2025-43740 is classified as a moderate severity stored cross-site scripting vulnerability.
How do I fix CVE-2025-43740?
To fix CVE-2025-43740, upgrade your Liferay Portal to version 7.4.3.133 or later and Liferay DXP to the respective patched versions mentioned in the advisory.
Which versions are affected by CVE-2025-43740?
CVE-2025-43740 affects Liferay Portal versions 7.4.3.120 to 7.4.3.132 and Liferay DXP versions across several 2024 and 2025 releases.
What kind of attack can CVE-2025-43740 facilitate?
CVE-2025-43740 can facilitate stored cross-site scripting attacks, allowing an attacker to inject malicious scripts into web pages displayed to users.
Is user data at risk because of CVE-2025-43740?
Yes, user data could potentially be at risk if an attacker successfully exploits CVE-2025-43740 to execute scripts in the context of the affected application.