{"id":"GHSA-r367-q549-pgr5","summary":"Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container","details":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.","aliases":["CVE-2025-43753"],"modified":"2025-08-22T19:29:41.944437Z","published":"2025-08-22T00:30:31Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-08-22T16:51:15Z","nvd_published_at":"2025-08-21T23:15:30Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43753"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/0a82d906b3489330d4e8552abe1b19ec2605323e"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/0b6a777f9d11668ebd8c9c53befeacd019b6719b"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/6ebe926008776c3f741f989a884ad07f02a79d9f"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/a2cf59ffd649bc0d9c1125f2b5a925669b68a546"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-18216"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43753"},{"type":"WEB","url":"http://github.com/liferay/liferay-portal/commit/d835c7331e38e048972ab4b8cf3106fc6767015f"}],"affected":[{"package":{"name":"com.liferay:com.liferay.layout.taglib","ecosystem":"Maven","purl":"pkg:maven/com.liferay/com.liferay.layout.taglib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.1.32"}]}],"versions":["1.0.0","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","10.0.5","11.0.0","11.0.1","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.1.0","11.1.1","11.2.0","11.2.1","11.2.2","11.3.0","12.0.0","12.0.1","13.0.0","13.0.1","13.0.2","13.0.3","13.0.4","13.1.0","13.1.1","13.1.2","13.1.3","13.1.4","13.1.5","13.1.6","13.1.7","13.1.8","14.0.0","14.0.1","14.0.2","14.1.0","14.1.1","14.1.2","14.2.0","15.0.0","15.0.1","15.0.2","15.0.3","16.0.0","16.1.0","16.1.1","16.1.10","16.1.11","16.1.12","16.1.13","16.1.14","16.1.15","16.1.16","16.1.17","16.1.18","16.1.19","16.1.2","16.1.20","16.1.21","16.1.22","16.1.23","16.1.24","16.1.25","16.1.26","16.1.27","16.1.28","16.1.29","16.1.3","16.1.30","16.1.31","16.1.4","16.1.5","16.1.6","16.1.7","16.1.8","16.1.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.29","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","3.0.0","3.0.1","3.0.10","3.0.11","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.19","3.1.2","3.1.20","3.1.21","3.1.22","3.1.23","3.1.24","3.1.25","3.1.26","3.1.27","3.1.28","3.1.29","3.1.3","3.1.30","3.1.31","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.10","4.1.11","4.1.12","4.1.13","4.1.14","4.1.15","4.1.16","4.1.17","4.1.18","4.1.19","4.1.2","4.1.20","4.1.21","4.1.22","4.1.23","4.1.24","4.1.25","4.1.26","4.1.27","4.1.28","4.1.29","4.1.3","4.1.30","4.1.31","4.1.32","4.1.33","4.1.34","4.1.35","4.1.36","4.1.37","4.1.38","4.1.39","4.1.4","4.1.40","4.1.41","4.1.42","4.1.43","4.1.44","4.1.45","4.1.46","4.1.47","4.1.48","4.1.49","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.19","5.3.2","5.3.20","5.3.21","5.3.22","5.3.23","5.3.24","5.3.25","5.3.26","5.3.27","5.3.28","5.3.29","5.3.3","5.3.30","5.3.31","5.3.32","5.3.33","5.3.34","5.3.35","5.3.36","5.3.37","5.3.38","5.3.39","5.3.4","5.3.40","5.3.41","5.3.42","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9","5.4.0","5.4.1","5.4.10","5.4.11","5.4.12","5.4.13","5.4.14","5.4.15","5.4.16","5.4.17","5.4.18","5.4.19","5.4.2","5.4.20","5.4.21","5.4.22","5.4.23","5.4.24","5.4.25","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","5.4.8","5.4.9","6.0.0","6.0.1","6.0.10","6.0.11","6.0.12","6.0.13","6.0.14","6.0.15","6.0.16","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.1.1","7.1.10","7.1.11","7.1.12","7.1.2","7.1.3","7.1.4","7.1.5","7.1.6","7.1.7","7.1.8","7.1.9","8.0.0","8.0.1","8.0.10","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","8.0.9","8.1.0","8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","9.0.0","9.1.0","9.1.1","9.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-r367-q549-pgr5/GHSA-r367-q549-pgr5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}