CVE-2025-43822

Description

Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 15 through update 92 allow remote attackers to inject arbitrary web script or HTML via crafted payload injected into a Terms and Conditions Name text field to (1) Payment Terms, or (2) the Delivery Term on the view order page.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.026

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-43822 are fixed in Liferay - release.portal.bom 7.4.3.112	Windows
Vulnerabilities CVE-2025-43822 are fixed in Liferay - release.portal.bom for Linux 7.4.3.112	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234