CVE-2025-43740

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-43740
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43740.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-43740
Aliases
Published
2025-08-19T13:15:41.400Z
Modified
2026-04-10T05:26:40.768238Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
d490ee1c4ab31706af8a50227eb597428025751b
Last affected
a9017d1f654503189fcd6eecd59bd501a7015b8c
Database specific 
{
    "versions": [
        {
            "introduced": "7.4.3.120"
        },
        {
            "last_affected": "7.4.3.132"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43740.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "2024.Q1.9"
            },
            {
                "fixed": "2024.Q1.20"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.Q2.1"
            },
            {
                "last_affected": "2024.Q2.13"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.q3.1"
            },
            {
                "last_affected": "2024.q3.13"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.q4.0"
            },
            {
                "last_affected": "2024.q4.7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2025.Q1.0"
            },
            {
                "fixed": "2025.Q1.16"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2025.Q2.0"
            },
            {
                "fixed": "2025.Q2.9"
            }
        ]
    }
]