Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

보통 6.1CVE-2025-43783 · GHSA-jhgr-j9cj-8j62 · Published 10/09/2025 · updated 26/09/2026

요약

CVE-2025-43783은(는) com.liferay:com.liferay.frontend.editor.ckeditor.web, digital experience platform (liferay), liferay portal (liferay)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.7%보다 높음.
조치: 5.0.102, 2024.Q1.13, 2024.Q3.2, 7.4.3.129 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.liferay:com.liferay.frontend.editor.ckeditor.web Maven	`≥ 5.0.76, < 5.0.102`	`5.0.102`
digital experience platform liferay	`= 7.4≥ 2024.Q1.1, < 2024.Q1.13≥ 2024.Q3.0, < 2024.Q3.2≥ 2024.q2.0, ≤ 2024.q2.13`	`2024.Q1.132024.Q3.2`
liferay portal liferay	`≥ 7.4.0, < 7.4.3.129`	`7.4.3.129`

Description

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

NVD description

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

References

nvd.nist.gov/vuln/detail/CVE-2025-43783 · ADVISORY
liferay/liferay-portal commit d7f9e94 · WEB
liferay/liferay-portal · PACKAGE
liferay.atlassian.net/browse/LPE-18085 · WEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783 · WEB

com.liferay:com.liferay.frontend.editor.ckeditor.web의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2025-43783은(는) com.liferay:com.liferay.frontend.editor.ckeditor.web, digital experience platform (liferay), liferay portal (liferay)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 15.7%보다 높음.

조치: 5.0.102, 2024.Q1.13, 2024.Q3.2, 7.4.3.129 이상으로 업데이트하세요.

Package

Affected versions

Patched versions

com.liferay:com.liferay.frontend.editor.ckeditor.web

Maven

≥ 5.0.76, < 5.0.102

5.0.102

digital experience platform

liferay

= 7.4≥ 2024.Q1.1, < 2024.Q1.13≥ 2024.Q3.0, < 2024.Q3.2≥ 2024.q2.0, ≤ 2024.q2.13

2024.Q1.132024.Q3.2

liferay portal

liferay

≥ 7.4.0, < 7.4.3.129

7.4.3.129

Description

NVD description

com.liferay:com.liferay.frontend.editor.ckeditor.web의 다른 취약점

모두 보기 →