CVE-2025-43760 json
Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect
published 2025-08-22 14 mo ago modified 2026-06-17 4 mo ago also GHSA-fvqv-593q-qp8r , EUVD-2025-25616
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect
Patch / fix
- liferay digital_experience_platform 2024.Q4.7, 2025.Q1.5
- github.com/liferay/liferay-portal@7a1a7f0 commit
- github.com/liferay/liferay-portal@7c742f3 commit
- github.com/liferay/liferay-portal@8f59892 commit
- github.com/liferay/liferay-portal@9485d39 commit
- github.com/liferay/liferay-portal@aa88fd9 commit
- github.com/liferay/liferay-portal@c457c6d commit
- github.com/liferay/liferay-portal@ddd3a57 commit
- github.com/liferay/liferay-portal@58b365f commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.0-ga1, <=7.4.3.132-ga132 |
no fix listed |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/liferay/liferay-portal/commit/7a1a7f0359e99be27ca04dab119e867c2263f040
web
-
github.com
/liferay/liferay-portal/commit/7c742f32f536dadfdbcad68acd20c63363728a25
web
-
github.com
/liferay/liferay-portal/commit/8f5989233fe36261df8e7bb356b1cc833ba4f34e
web
-
github.com
/liferay/liferay-portal/commit/9485d39fa2b66cfc075b16fddaafa9fca64a5687
web
-
github.com
/liferay/liferay-portal/commit/aa88fd90657cd83d92ed2e6fbcbc28e5cf7e3fca
web
-
github.com
/liferay/liferay-portal/commit/c457c6d72685db48ed07562a33c67d7998e88b27
web
-
github.com
/liferay/liferay-portal/commit/ddd3a57cd5d3a8891673491b8b6cb680dff1f3c5
web
-
github.com
/liferay/liferay-portal/commit/58b365ffe2f088b308cfae207474ade3e143bbf9
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43760
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18156
web
Sources
- CVE List CVE-2025-43760
- GitHub Advisory GHSA-fvqv-593q-qp8r
- NVD CVE-2025-43760
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.