CVE-2025-43775: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and Liferay DXP, identified as CVE-2025-43775. The vulnerability was disclosed on September 9, 2025, affecting Liferay Portal versions 7.4.0 through 7.4.3.128, and Liferay DXP versions 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92. The vulnerability was reported by milCERT AT (Liferay Advisory).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via the remote app title field. The severity of this vulnerability has been rated with a CVSS v4.0 score of 4.6 (Medium), with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. This indicates that the vulnerability requires high privileges and user interaction to exploit (Liferay Advisory, NVD).

The vulnerability can lead to the execution of arbitrary web scripts or HTML injection in the context of other users' browsers who access the affected application. This could potentially lead to theft of sensitive data, session hijacking, or other malicious actions performed in the context of the affected users (AttackerKB).

Fixed versions have been released to address this vulnerability. Organizations should upgrade to Liferay Portal version 7.4.3.129, Liferay DXP 2024.Q1.13, Liferay DXP 2024.Q3.6, or Liferay DXP 2024.Q4.0 to mitigate this vulnerability (Liferay Advisory).