CVE-2025-43735
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-12-16
Assigner: Liferay Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liferay | digital_experience_platform | From 2024.q1.1 (inc) to 2024.q1.12 (inc) |
| liferay | digital_experience_platform | From 2024.q2.0 (inc) to 2024.q2.13 (inc) |
| liferay | digital_experience_platform | From 2024.q3.1 (inc) to 2024.q3.13 (inc) |
| liferay | digital_experience_platform | From 2024.q4.0 (inc) to 2024.q4.7 (inc) |
| liferay | digital_experience_platform | 7.4 |
| liferay | liferay_portal | From 7.4.0 (inc) to 7.4.3.131 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in the google_widget component of Liferay Portal and Liferay DXP. It allows a remote, unauthenticated attacker to inject malicious JavaScript code into the google_gadget, which can then be executed on the client side when a user interacts with the affected component. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can execute arbitrary JavaScript code in the context of the affected web application on a user's browser. This can lead to client-side script execution, potentially resulting in theft of user data, session hijacking, or other malicious actions. However, the CVSS score indicates low impact on confidentiality, integrity, and availability. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade affected Liferay Portal and Liferay DXP versions to the fixed releases: Liferay Portal 7.4.3.132, Liferay DXP 2024.Q1.13, or Liferay DXP 2025.Q1.0. Applying these updates will address the reflected XSS vulnerability in the google_gadget component. [1]