GHSA-3p2m-574v-v257

Liferay Portal Vulnerable to Cross-Site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43731

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay.portal:release.portal.bom	>= 7.4.0-ga1, <= 7.4.3.132-ga132	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43731 advisory
https://github.com/liferay/liferay-portal/commit/41708aa542c103521427ecf06f4b20cb37c65ecf web
https://github.com/liferay/liferay-portal/commit/cd1c692dfed3bbebe10074ecb89c561893fffaf9 web
https://github.com/liferay/liferay-portal/commit/f23921fc93cf713f27ed9c4d31b8c1854c0e2abb web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18217 web
https://liferay.atlassian.net/browse/LPE-18219 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731 web