~ / search / GHSA-x5fw-8xgx-q6c9

GHSA-x5fw-8xgx-q6c9

Liferay Portal is vulnerable to XSS attack through its search bar portlet

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43781

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay:com.liferay.portal.search.web >= 6.0.125, < 6.0.143 6.0.143

Details

As written in the advisory (Markdown source, shown as plain text).

A reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portlet

References

External links from the advisory. They lead to third-party sites.