GHSA-jhgr-j9cj-8j62

Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43783

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.frontend.editor.ckeditor.web	>= 5.0.76, < 5.0.102	5.0.102

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor path.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43783 advisory
https://github.com/liferay/liferay-portal/commit/d7f9e94e0ebb63b04ac77d6253fe16dbd914bdf1 web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18085 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43783 web