PT-2025-34472 · Liferay · Liferay Portal+1

CVE-2025-43760

·

Publicado

2025-08-22

·

Atualizado

2025-12-16

CVSS v3.1

5.4

Média

VetorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.4 Liferay DXP versions 2024.Q4.0 through 2024.Q4.6 Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.20 Liferay DXP 7.4 GA through update 92
Description: A reflected cross-site scripting (XSS) vulnerability exists that allows a remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect function.
Recommendations: Liferay Portal versions 7.4.0 through 7.4.3.132 should be updated. Liferay DXP versions 2025.Q1.0 through 2025.Q1.4 should be updated. Liferay DXP versions 2024.Q4.0 through 2024.Q4.6 should be updated. Liferay DXP versions 2024.Q3.0 through 2024.Q3.13 should be updated. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 should be updated. Liferay DXP versions 2024.Q1.1 through 2024.Q1.20 should be updated. Liferay DXP 7.4 GA through update 92 should be updated.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-43760
GHSA-FVQV-593Q-QP8R

Produtos afetados

Liferay Dxp
Liferay Portal