CVE-2025-43791: 
Java vulnerability analysis and mitigation

CVE-2025-43791 is a cross-site scripting (XSS) vulnerability discovered in Liferay Portal and Liferay DXP platforms. The vulnerability was disclosed on September 15, 2025, affecting multiple versions including Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 36 (Liferay Advisory, NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through a crafted payload inserted into a 'Rich Text' type field. The attack vectors include web content structure, Documents and Media Document Type, and custom assets utilizing the Data Engine's module Rich Text field. The vulnerability has been assigned a CVSS v4.0 score of 4.8 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. The weakness is categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation) (Liferay Advisory).

The vulnerability can lead to cross-site scripting attacks, potentially allowing attackers to inject malicious web scripts or HTML content into the affected systems. This could result in compromised user sessions, data theft, or manipulation of web content displayed to users (NVD).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.1, or Liferay DXP 2023.Q3.5 (Liferay Advisory).