CVE-2025-43802: XSS
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35 allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.
Other sources
Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43802?
CVE-2025-43802 is classified as a moderate severity stored XSS vulnerability affecting specific versions of Liferay Portal and Liferay DXP.
How do I fix CVE-2025-43802?
To fix CVE-2025-43802, update Liferay Portal or Liferay DXP to the patched versions provided by the vendor, which are released after the vulnerable versions.
What versions are affected by CVE-2025-43802?
CVE-2025-43802 affects Liferay Portal versions 7.4.3.51 to 7.4.3.109 and Liferay DXP versions 2023.Q3.1 to 2023.Q3.4.
What type of vulnerability is CVE-2025-43802?
CVE-2025-43802 is a stored cross-site scripting (XSS) vulnerability found in specific API endpoints.
Who can be affected by CVE-2025-43802?
Remote attackers can exploit CVE-2025-43802 to inject arbitrary scripts into applications utilizing vulnerable instances of Liferay Portal or Liferay DXP.