{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"7.4.3.120-ga120","last_affected":"7.4.3.132-ga23"}],"component":"com.liferay.portal:release.portal.bom","cve_ids":["CVE-2025-43740"],"ecosystem":"Maven","epss":0.00217,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-22jp-w3cg-gvmm","id":"tcs_01M5N8591SY7JPQQQPC926H9QC","modified_at":"2025-08-19T22:42:19.609439Z","published_at":"2025-08-19T15:31:28Z","references":["https://osv.dev/vulnerability/GHSA-22jp-w3cg-gvmm","https://nvd.nist.gov/vuln/detail/CVE-2025-43740","https://github.com/liferay/liferay-portal/commit/32821b41f7f62271d1fb9d56c82297cd087780a4","https://github.com/liferay/liferay-portal/commit/51e21fa8b3e8b49ed455caeab192c5bba7e15b6d","https://github.com/liferay/liferay-portal/commit/c1b7c6b58f5042072c381fc2664e808ebb745826","https://github.com/liferay/liferay-portal","https://liferay.atlassian.net/browse/LPE-18276","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43740"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-22jp-w3cg-gvmm","url":"https://osv.dev/vulnerability/GHSA-22jp-w3cg-gvmm"},{"source":"nvd","source_id":"CVE-2025-43740","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43740"}],"summary":"Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature"}