CVE-2025-43812
Essential information
- Published
- 29/09/2025 23:15
- Modified
- 29/09/2025 23:15
- Author
- —
- Creator
- —
- CVSS
- 4.8 MEDIUM (v3) 4.8 MEDIUM (v4.0)
- CISA KEV
- No
- CWE
- —
- CVSS vector
-
—
—
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- —
- Attack complexity
- —
- Privileges required
- —
- User interaction
- —
- Scope
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- NETWORK
- Attack complexity
- LOW
- Attack requirements
- NONE
- Privileges required
- LOW
- User interaction
- ACTIVE
- Confidentiality (V)
- LOW
- Confidentiality (S)
- LOW
- Integrity (V)
- LOW
- Integrity (S)
- LOW
- Availability (V)
- NONE
- Availability (S)
- NONE
- Exploit maturity
- NOT_DEFINED
Description
Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field
NVD status
- Status
- Received — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- [email protected]
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| liferay / liferay portal | cpe:2.3:a:liferay:liferay_portal:7.4.3.4-7.4.3.111:*:*:*:*:*:*:* |
| liferay / liferay dxp | cpe:2.3:a:liferay:liferay_dxp:2023.Q4.0-2023.Q4.4:*:*:*:*:*:*:* |
| liferay / liferay dxp | cpe:2.3:a:liferay:liferay_dxp:2023.Q3.1-2023.Q3.8:*:*:*:*:*:*:* |
| liferay / liferay portal | cpe:2.3:a:liferay:liferay_portal:7.4:92:*:*:*:*:*:* |