CVE-2025-43802: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and Liferay DXP's custom object's /o/c/ API endpoint, identified as CVE-2025-43802. The vulnerability was discovered on September 17, 2024, affecting multiple versions of Liferay DXP and Portal products. The vulnerability allows remote attackers to inject arbitrary web script or HTML through the externalReferenceCode parameter (Liferay Security).

The vulnerability has been assigned a CVSS v4.0 score of 4.8 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. The vulnerability exists in the custom object's /o/c/ API endpoint where insufficient validation of the externalReferenceCode parameter allows for XSS payload injection (Liferay Security).

The vulnerability allows attackers to inject malicious web scripts or HTML content through the application's API endpoint, potentially leading to the execution of unauthorized client-side code in users' browsers. The impact is considered low to medium as it requires user interaction and authenticated access (Liferay Security).

The vulnerability has been fixed in multiple versions including Liferay Portal 7.4.3.110, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.1, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).