CVE-2025-43742: XSS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43742?
CVE-2025-43742 is considered a high severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-43742?
To fix CVE-2025-43742, upgrade Liferay Portal and Liferay DXP to the latest patched versions beyond the affected ranges.
Which versions are affected by CVE-2025-43742?
CVE-2025-43742 affects Liferay Portal 7.4.0 to 7.4.3.132 and several versions of Liferay DXP within specific ranges.
What type of vulnerability is CVE-2025-43742?
CVE-2025-43742 is a reflected cross-site scripting (XSS) vulnerability.
Who is the vendor associated with CVE-2025-43742?
The vendor associated with CVE-2025-43742 is Liferay.