GHSA-fvqv-593q-qp8r

Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43760

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay.portal:release.portal.bom	>= 7.4.0-ga1, <= 7.4.3.132-ga132	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43760 advisory
https://github.com/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040 web
https://github.com/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25 web
https://github.com/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e web
https://github.com/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687 web
https://github.com/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca web
https://github.com/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27 web
https://github.com/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5 web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18156 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760 web
http://github.com/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9 web