GHSA-88g3-pv3w-5wmr

Liferay Portal is vulnerable to XSS attacks via its remote app title field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43775

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.client.extension.web	>= 1.0.71, < 2.0.27	2.0.27

Details

As written in the advisory (Markdown source, shown as plain text).

A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote app title field.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43775 advisory
https://github.com/liferay/liferay-portal/commit/e54b2b41564df4f11cfa77b3e6c4353cf0a3b16d web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18123 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43775 web