CVE-2025-43783
BaseFortify
Publication date: 2025-09-10
Last updated on: 2025-12-16
Assigner: Liferay Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liferay | digital_experience_platform | From 2024.Q1.1 (inc) to 2024.Q1.13 (exc) |
| liferay | digital_experience_platform | From 2024.q2.0 (inc) to 2024.q2.13 (inc) |
| liferay | digital_experience_platform | From 2024.Q3.0 (inc) to 2024.Q3.2 (exc) |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | digital_experience_platform | 7.4 |
| liferay | liferay_portal | From 7.4.0 (inc) to 7.4.3.129 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-43783 is a reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP products. It occurs on the "/c/portal/comment/discussion/get_editor" path, allowing remote attackers to inject arbitrary web scripts or HTML. This means an attacker can craft a malicious link or input that, when visited or executed by a user, runs unwanted scripts in the user's browser. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /c/portal/comment/discussion/get_editor path for reflected cross-site scripting (XSS) by injecting typical XSS payloads and observing if the input is reflected without proper sanitization. For example, you can use curl or a web vulnerability scanner to send requests with script tags or HTML payloads to this endpoint and check the response for reflected scripts. A sample command using curl might be: curl -i -G --data-urlencode 'param=<script>alert(1)</script>' https://your-liferay-instance/c/portal/comment/discussion/get_editor and then inspect the response for the injected script. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Liferay Portal or Liferay DXP to the fixed versions: Liferay Portal 7.4.3.129 or later, Liferay DXP 2024.Q1.13 or later, Liferay DXP 2024.Q3.2 or later, or Liferay DXP 2024.Q4.0 or later. Until an upgrade is possible, consider implementing web application firewall (WAF) rules to block or sanitize requests to the /c/portal/comment/discussion/get_editor path that contain suspicious script or HTML content to prevent exploitation. [1]
How can this vulnerability impact me? :
This vulnerability can allow remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user data, session hijacking, or other malicious actions performed on behalf of the user. However, the attack requires user interaction and has low impact on confidentiality and integrity, with no impact on availability. [1]