CVE-2025-43783

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-43783
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43783.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-43783
Aliases
Published
2025-09-10T20:15:33.977Z
Modified
2026-07-11T04:48:06.185108Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2024.Q1.1"
                },
                {
                    "fixed": "2024.Q1.13"
                },
                {
                    "introduced": "2024.q2.0"
                },
                {
                    "last_affected": "2024.q2.13"
                },
                {
                    "introduced": "2024.Q3.0"
                },
                {
                    "fixed": "2024.Q3.2"
                }
            ],
            "vendor_product": "liferay:digital_experience_platform",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.4-update73"
                },
                {
                    "last_affected": "7.4-update73"
                },
                {
                    "introduced": "7.4-update74"
                },
                {
                    "last_affected": "7.4-update74"
                },
                {
                    "introduced": "7.4-update75"
                },
                {
                    "last_affected": "7.4-update75"
                },
                {
                    "introduced": "7.4-update76"
                },
                {
                    "last_affected": "7.4-update76"
                },
                {
                    "introduced": "7.4-update77"
                },
                {
                    "last_affected": "7.4-update77"
                },
                {
                    "introduced": "7.4-update78"
                },
                {
                    "last_affected": "7.4-update78"
                },
                {
                    "introduced": "7.4-update79"
                },
                {
                    "last_affected": "7.4-update79"
                },
                {
                    "introduced": "7.4-update80"
                },
                {
                    "last_affected": "7.4-update80"
                },
                {
                    "introduced": "7.4-update81"
                },
                {
                    "last_affected": "7.4-update81"
                },
                {
                    "introduced": "7.4-update82"
                },
                {
                    "last_affected": "7.4-update82"
                },
                {
                    "introduced": "7.4-update83"
                },
                {
                    "last_affected": "7.4-update83"
                },
                {
                    "introduced": "7.4-update84"
                },
                {
                    "last_affected": "7.4-update84"
                },
                {
                    "introduced": "7.4-update85"
                },
                {
                    "last_affected": "7.4-update85"
                },
                {
                    "introduced": "7.4-update86"
                },
                {
                    "last_affected": "7.4-update86"
                },
                {
                    "introduced": "7.4-update87"
                },
                {
                    "last_affected": "7.4-update87"
                },
                {
                    "introduced": "7.4-update88"
                },
                {
                    "last_affected": "7.4-update88"
                },
                {
                    "introduced": "7.4-update89"
                },
                {
                    "last_affected": "7.4-update89"
                },
                {
                    "introduced": "7.4-update90"
                },
                {
                    "last_affected": "7.4-update90"
                },
                {
                    "introduced": "7.4-update91"
                },
                {
                    "last_affected": "7.4-update91"
                },
                {
                    "introduced": "7.4-update92"
                },
                {
                    "last_affected": "7.4-update92"
                }
            ],
            "vendor_product": "liferay:digital_experience_platform",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
ec84d86679146b84af526f96471a730c340dda78
Fixed
9bc3ecc0e54e74532403f3b281d3d542e95babd8
Database specific 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.3.129"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*
7.4.0-ga1
7.4.1-ga2
7.4.2-ga3
7.4.3.4-ga4
7.4.3.41-ga41
7.4.3.5-ga5
7.4.3.6-ga6
7.4.3.7-ga7
7.4.3.88-ga88

Database specific

vanir_signatures_modified 
"2026-07-11T04:48:06Z"
vanir_signatures 
[
    {
        "target": {
            "function": "testUpgradeProcess",
            "file": "modules/apps/dynamic-data-mapping/dynamic-data-mapping-test/src/testIntegration/java/com/liferay/dynamic/data/mapping/internal/upgrade/v5_6_1/test/DDMFieldAttributeUpgradeProcessTest.java"
        },
        "id": "CVE-2025-43783-89cd59f6",
        "digest": {
            "function_hash": "57115968376390560967885530032985434205",
            "length": 304.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/liferay/liferay-portal/commit/9bc3ecc0e54e74532403f3b281d3d542e95babd8"
    },
    {
        "target": {
            "file": "modules/apps/dynamic-data-mapping/dynamic-data-mapping-test/src/testIntegration/java/com/liferay/dynamic/data/mapping/internal/upgrade/v5_6_1/test/DDMFieldAttributeUpgradeProcessTest.java"
        },
        "id": "CVE-2025-43783-ee25579f",
        "digest": {
            "line_hashes": [
                "179772675958613422767713377468908871682",
                "244399705317510526091317168555219523761",
                "132569019723834552443776610039766080788",
                "32054084799560152186930759783497281023",
                "234529184054465291764936572438166749093",
                "78377685304783572495740352849876029142",
                "134663871138638082137858968838889813557",
                "7936592204798143019898109296741974255"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/liferay/liferay-portal/commit/9bc3ecc0e54e74532403f3b281d3d542e95babd8"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43783.json"