~ / search / GHSA-wmjx-xv9v-r89q

GHSA-wmjx-xv9v-r89q

Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43815

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay:com.liferay.product.navigation.control.menu.web >= 6.0.80, < 6.0.83 6.0.83

Details

As written in the advisory (Markdown source, shown as plain text).

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

References

External links from the advisory. They lead to third-party sites.