CVE-2025-43817: 
Java vulnerability analysis and mitigation

Multiple reflected cross-site scripting (XSS) vulnerabilities were discovered in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92. The vulnerability was disclosed on October 23, 2024 (Liferay Security).

The vulnerability allows remote attackers to inject arbitrary web script or HTML via the redirect parameter in two specific components: (1) Announcements and (2) Alerts. The vulnerability has been assigned a CVSS v4.0 score of 4.8 (Medium), with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (Liferay Security).

The vulnerability enables attackers to execute arbitrary web scripts or inject HTML content through the affected components, potentially leading to cross-site scripting attacks. The impact is considered moderate as it requires user interaction and has limited potential for damage (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.112, Liferay DXP 2023.Q3.9, Liferay DXP 2023.Q4.7, and Liferay DXP 2024.Q1.1. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Security).