GHSA-r367-q549-pgr5

Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container

Source: GitHub Advisory Database (reviewed) Low CVE-2025-43753

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.layout.taglib	< 16.1.32	16.1.32

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43753 advisory
https://github.com/liferay/liferay-portal/commit/0a82d906b3489330d4e8552abe1b19ec2605323e web
https://github.com/liferay/liferay-portal/commit/0b6a777f9d11668ebd8c9c53befeacd019b6719b web
https://github.com/liferay/liferay-portal/commit/6ebe926008776c3f741f989a884ad07f02a79d9f web
https://github.com/liferay/liferay-portal/commit/a2cf59ffd649bc0d9c1125f2b5a925669b68a546 web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18216 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43753 web
http://github.com/liferay/liferay-portal/commit/d835c7331e38e048972ab4b8cf3106fc6767015f web