CVE-2025-43740 Security Details

CVE ID

CVE-2025-43740

CWE

CWE-79

CVE Description

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13 and 2024.Q1.9 through 2024.Q1.19 allows an remote authenticated attacker to inject JavaScript through the message boards feature available via the web interface.

Published

Aug 20, 2025

CVSS Score & Severity

5.4Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

0.041%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/liferay/portal/kernel/sanitizer/SanitizerUtil.sanitize(JJJLjava/lang/String;JLjava/lang/String;Ljava/lang/String;Ljava/lang/String;Ljava/util/Map;)Ljava/lang/String;

JVMVulnerable params: 7

com/liferay/portal/sanitizer/SanitizerImpl.sanitize(JJJLjava/lang/String;JLjava/lang/String;[Ljava/lang/String;Ljava/lang/String;Ljava/util/Map;)Ljava/lang/String;

JVMVulnerable params: 7

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-22jp-w3cg-gvmmTHIRD_PARTY