medium5.1
CVE-2025-43804
Liferay search widget vulnerable to Cross-site Scripting
Impact
There is a Cross-site scripting (XSS) vulnerability in Liferay Portal's Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the `_com_liferay_portal_search_web_portlet_SearchPortlet_userId` parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.portal.search | < 8.0.93 | 8.0.93 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Digital Experience Platform | Versions 2023.q3.0, 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4, 2023.q4.0 |
| Liferay | Liferay Portal | from 7.4.3.93 before 7.4.3.112 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43804
- https://github.com/advisories/GHSA-ccrc-5vp5-vp5j
- https://nvd.nist.gov/vuln/detail/CVE-2025-43804
- https://github.com/liferay/liferay-portal/commit/141f3fc8379e56831fae45a5b2647e86dab9d265
- https://liferay.atlassian.net/browse/LPE-17892