CVE-2025-43820: digital experience platform from 2023.Q3.1 (inclusive), before 2023.Q3.7 (exclusive), from 2023.Q4.0 (inclusive)…

Affected technology

digital experience platform · from 2023.Q3.1 (inclusive), before 2023.Q3.7 (exclusive)
liferay

digital experience platform · from 2023.Q4.0 (inclusive), before 2023.Q4.5 (exclusive)
liferay

digital experience platform · 7.3 · update update25
liferay

digital experience platform · 7.3 · update update26
liferay

digital experience platform · 7.3 · update update27
liferay

digital experience platform · 7.3 · update update28
liferay

digital experience platform · 7.3 · update update29
liferay

digital experience platform · 7.3 · update update30
liferay

digital experience platform · 7.3 · update update31
liferay

digital experience platform · 7.3 · update update32
liferay

digital experience platform · 7.3 · update update33
liferay

digital experience platform · 7.3 · update update34
liferay

digital experience platform · 7.3 · update update35
liferay

digital experience platform · 7.3 · update update36
liferay

digital experience platform · 7.4 · update update35
liferay

digital experience platform · 7.4 · update update36
liferay

digital experience platform · 7.4 · update update37
liferay

digital experience platform · 7.4 · update update38
liferay

digital experience platform · 7.4 · update update39
liferay

digital experience platform · 7.4 · update update40
liferay

digital experience platform · 7.4 · update update41
liferay

digital experience platform · 7.4 · update update42
liferay

digital experience platform · 7.4 · update update43
liferay

digital experience platform · 7.4 · update update44
liferay

digital experience platform · 7.4 · update update45
liferay

digital experience platform · 7.4 · update update46
liferay

digital experience platform · 7.4 · update update47
liferay

digital experience platform · 7.4 · update update48
liferay

digital experience platform · 7.4 · update update49
liferay

digital experience platform · 7.4 · update update50
liferay

digital experience platform · 7.4 · update update51
liferay

digital experience platform · 7.4 · update update52
liferay

digital experience platform · 7.4 · update update53
liferay

digital experience platform · 7.4 · update update54
liferay

digital experience platform · 7.4 · update update55
liferay

digital experience platform · 7.4 · update update56
liferay

digital experience platform · 7.4 · update update57
liferay

digital experience platform · 7.4 · update update58
liferay

digital experience platform · 7.4 · update update59
liferay

digital experience platform · 7.4 · update update60
liferay

digital experience platform · 7.4 · update update61
liferay

digital experience platform · 7.4 · update update62
liferay

digital experience platform · 7.4 · update update63
liferay

digital experience platform · 7.4 · update update64
liferay

digital experience platform · 7.4 · update update65
liferay

digital experience platform · 7.4 · update update66
liferay

digital experience platform · 7.4 · update update67
liferay

digital experience platform · 7.4 · update update68
liferay

digital experience platform · 7.4 · update update69
liferay

digital experience platform · 7.4 · update update70
liferay

digital experience platform · 7.4 · update update71
liferay

digital experience platform · 7.4 · update update72
liferay

digital experience platform · 7.4 · update update73
liferay

digital experience platform · 7.4 · update update74
liferay

digital experience platform · 7.4 · update update75
liferay

digital experience platform · 7.4 · update update76
liferay

digital experience platform · 7.4 · update update77
liferay

digital experience platform · 7.4 · update update78
liferay

digital experience platform · 7.4 · update update79
liferay

digital experience platform · 7.4 · update update80
liferay

digital experience platform · 7.4 · update update81
liferay

digital experience platform · 7.4 · update update82
liferay

digital experience platform · 7.4 · update update83
liferay

digital experience platform · 7.4 · update update84
liferay

digital experience platform · 7.4 · update update85
liferay

digital experience platform · 7.4 · update update86
liferay

digital experience platform · 7.4 · update update87
liferay

digital experience platform · 7.4 · update update88
liferay

digital experience platform · 7.4 · update update89
liferay

digital experience platform · 7.4 · update update90
liferay

digital experience platform · 7.4 · update update91
liferay

digital experience platform · 7.4 · update update92
liferay

liferay portal · from 7.4.3.35 (inclusive), before 7.4.3.111 (exclusive)
liferay

Portal · 7.4.3.35 through 7.4.3.110
Liferay

DXP · 7.3.10-u25 through 7.3.10-u36, 7.4.13-u35 through 7.4.13-u92, 2023.Q3.1 through 2023.Q3.6, 2023.Q4.0 through 2023.Q4.4
Liferay

Description’s affected range: through 7.4.3.110

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

The source says multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle text, or (3) Last Name text fields. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.