CVE-2025-43735: 
Java vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and Liferay DXP, identified as CVE-2025-43735. The vulnerability was disclosed on August 12, 2025, affecting multiple versions of Liferay Portal (7.4.0 through 7.4.3.131) and Liferay DXP versions (2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92). The vulnerability was discovered by security researcher Shailesh Suthar (@shailesh4594) (Liferay Security).

The vulnerability is classified as a reflected cross-site scripting (XSS) issue (CWE-79) that specifically affects the google_gadget component. The severity of the vulnerability has been assessed with a CVSS v4.0 score of 6.9 (Medium), with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (NVD Database).

The vulnerability allows remote non-authenticated attackers to inject JavaScript code into the google_gadget component, potentially leading to unauthorized script execution in users' browsers. This could result in compromised user sessions, data theft, or manipulation of the affected web interface (Liferay Security).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal version 7.4.3.132, Liferay DXP 2024.Q1.13, or Liferay DXP 2025.Q1.0 to mitigate the risk (Liferay Security).