CVE-2025-43771 json
Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields
published 2025-10-08 13 mo ago modified 2026-10-18 21 d ago also GHSA-q8fj-76q7-4p7h , EUVD-2025-33163
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.10 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into (1) a user’s “First Name” text field, (2) a user’s “Middle Name” text field, (3) a user’s “Last Name” text field, (4) the “Other Reason” text field when flagging content, or (5) the name of the flagged content.
Patch / fix
- maven com.liferay:com.liferay.flags.web 6.0.24
- liferay digital_experience_platform 2023.Q3.4, 2023.q4.6
- liferay liferay_portal 7.4.3.112
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.flags.web | >=6.0.23, <6.0.24 |
6.0.24 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/liferay/liferay-portal/commit/0f1f6b628d40c9fc59ad6f561f6bdcc1208b5dbb
web
-
github.com
/liferay/liferay-portal/commit/28dc724658e13acb80f30fb3211d0849592ec4ef
web
-
github.com
/liferay/liferay-portal/commit/90b677d7ca74464f2079266588a67fa56aca842d
web
-
github.com
/liferay/liferay-portal/commit/cca5fe50a5b63000c3ca7469b668af9399025e90
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43771
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43771
advisory
-
github.com
/liferay/liferay-portal
web
-
liferay.atlassian.net
/browse/LPE-17917
web
Sources
- CVE List CVE-2025-43771
- GitHub Advisory GHSA-q8fj-76q7-4p7h
- NVD CVE-2025-43771
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.