CVE-2025-43733: 
Java vulnerability analysis and mitigation

CVE-2025-43733 is a reflected cross-site scripting (XSS) vulnerability discovered in Liferay Portal 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.7. The vulnerability was disclosed on August 18, 2025, and affects the content page's name field functionality (NVD, Liferay Security).

The vulnerability allows a remote authenticated attacker to inject JavaScript code via the content page's name field, which is then reflected and executed within the user's browser when viewing the 'document View Usages' page. The vulnerability has been assigned a CVSS v4.0 score of 2.3 (LOW) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD, Liferay Security).

The exploitation of this vulnerability could lead to the execution of malicious JavaScript code in the context of other users' browsers who view the affected page, potentially leading to session hijacking, defacement, or theft of sensitive browser-based data (NVD).

The vulnerability has been fixed in Liferay Portal's master branch and Liferay DXP versions 2025.Q2.0, 2025.Q1.8, and 2024.Q1.17. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).