{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "7.4.3.51"
              },
              {
                "fixed": "7.4.3.110"
              }
            ],
            "source": "CPE_RANGE"
          },
          "events": [
            {
              "introduced": "77a85fc3c873ef883838f19dc1c8c71b4ef36128"
            },
            {
              "fixed": "674473979b30a8ac9a35b548c1bfb84bc45f45c5"
            }
          ],
          "repo": "https://github.com/liferay/liferay-portal",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "unresolved_ranges": [
      {
        "cpes": [
          "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "2023.q3.1"
          },
          {
            "fixed": "2023.q3.5"
          }
        ],
        "source": "CPE_RANGE",
        "vendor_product": "liferay:digital_experience_platform"
      },
      {
        "cpes": [
          "cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
          "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
        ],
        "extracted_events": [
          {
            "introduced": "7.3-update33"
          },
          {
            "last_affected": "7.3-update33"
          },
          {
            "introduced": "7.3-update34"
          },
          {
            "last_affected": "7.3-update34"
          },
          {
            "introduced": "7.3-update35"
          },
          {
            "last_affected": "7.3-update35"
          },
          {
            "introduced": "7.4-update51"
          },
          {
            "last_affected": "7.4-update51"
          },
          {
            "introduced": "7.4-update52"
          },
          {
            "last_affected": "7.4-update52"
          },
          {
            "introduced": "7.4-update53"
          },
          {
            "last_affected": "7.4-update53"
          },
          {
            "introduced": "7.4-update54"
          },
          {
            "last_affected": "7.4-update54"
          },
          {
            "introduced": "7.4-update55"
          },
          {
            "last_affected": "7.4-update55"
          },
          {
            "introduced": "7.4-update56"
          },
          {
            "last_affected": "7.4-update56"
          },
          {
            "introduced": "7.4-update57"
          },
          {
            "last_affected": "7.4-update57"
          },
          {
            "introduced": "7.4-update58"
          },
          {
            "last_affected": "7.4-update58"
          },
          {
            "introduced": "7.4-update59"
          },
          {
            "last_affected": "7.4-update59"
          },
          {
            "introduced": "7.4-update60"
          },
          {
            "last_affected": "7.4-update60"
          },
          {
            "introduced": "7.4-update61"
          },
          {
            "last_affected": "7.4-update61"
          },
          {
            "introduced": "7.4-update62"
          },
          {
            "last_affected": "7.4-update62"
          },
          {
            "introduced": "7.4-update63"
          },
          {
            "last_affected": "7.4-update63"
          },
          {
            "introduced": "7.4-update64"
          },
          {
            "last_affected": "7.4-update64"
          },
          {
            "introduced": "7.4-update65"
          },
          {
            "last_affected": "7.4-update65"
          },
          {
            "introduced": "7.4-update66"
          },
          {
            "last_affected": "7.4-update66"
          },
          {
            "introduced": "7.4-update67"
          },
          {
            "last_affected": "7.4-update67"
          },
          {
            "introduced": "7.4-update68"
          },
          {
            "last_affected": "7.4-update68"
          },
          {
            "introduced": "7.4-update69"
          },
          {
            "last_affected": "7.4-update69"
          },
          {
            "introduced": "7.4-update70"
          },
          {
            "last_affected": "7.4-update70"
          },
          {
            "introduced": "7.4-update71"
          },
          {
            "last_affected": "7.4-update71"
          },
          {
            "introduced": "7.4-update72"
          },
          {
            "last_affected": "7.4-update72"
          },
          {
            "introduced": "7.4-update73"
          },
          {
            "last_affected": "7.4-update73"
          },
          {
            "introduced": "7.4-update74"
          },
          {
            "last_affected": "7.4-update74"
          },
          {
            "introduced": "7.4-update75"
          },
          {
            "last_affected": "7.4-update75"
          },
          {
            "introduced": "7.4-update76"
          },
          {
            "last_affected": "7.4-update76"
          },
          {
            "introduced": "7.4-update77"
          },
          {
            "last_affected": "7.4-update77"
          },
          {
            "introduced": "7.4-update78"
          },
          {
            "last_affected": "7.4-update78"
          },
          {
            "introduced": "7.4-update79"
          },
          {
            "last_affected": "7.4-update79"
          },
          {
            "introduced": "7.4-update80"
          },
          {
            "last_affected": "7.4-update80"
          },
          {
            "introduced": "7.4-update81"
          },
          {
            "last_affected": "7.4-update81"
          },
          {
            "introduced": "7.4-update82"
          },
          {
            "last_affected": "7.4-update82"
          },
          {
            "introduced": "7.4-update83"
          },
          {
            "last_affected": "7.4-update83"
          },
          {
            "introduced": "7.4-update84"
          },
          {
            "last_affected": "7.4-update84"
          },
          {
            "introduced": "7.4-update85"
          },
          {
            "last_affected": "7.4-update85"
          },
          {
            "introduced": "7.4-update86"
          },
          {
            "last_affected": "7.4-update86"
          },
          {
            "introduced": "7.4-update87"
          },
          {
            "last_affected": "7.4-update87"
          },
          {
            "introduced": "7.4-update88"
          },
          {
            "last_affected": "7.4-update88"
          },
          {
            "introduced": "7.4-update89"
          },
          {
            "last_affected": "7.4-update89"
          },
          {
            "introduced": "7.4-update90"
          },
          {
            "last_affected": "7.4-update90"
          },
          {
            "introduced": "7.4-update91"
          },
          {
            "last_affected": "7.4-update91"
          },
          {
            "introduced": "7.4-update92"
          },
          {
            "last_affected": "7.4-update92"
          }
        ],
        "source": "CPE_STRING",
        "vendor_product": "liferay:digital_experience_platform"
      }
    ]
  },
  "details": "Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/\u003cobject-name\u003e API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.",
  "id": "CVE-2025-43802",
  "modified": "2026-09-05T03:30:52.355167323Z",
  "published": "2025-09-15T22:15:34.030Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43802"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}