CVE-2025-43770 json
Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter
published 2025-08-23 14 mo ago modified 2026-06-17 4 mo ago also GHSA-h4m4-xp33-37mj , EUVD-2025-25724
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.
Patch / fix
- maven com.liferay.portal:com.liferay.portal.kernel 155.0.0
- liferay digital_experience_platform 2024.Q1.13, 2024.Q4.4
- liferay liferay_portal 7.4.3.132
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:com.liferay.portal.kernel | <155.0.0 |
155.0.0 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/liferay/liferay-portal/commit/a712758b9c4b6f4c54df5dec7d334279bb30f75a
web
-
github.com
/liferay/liferay-portal/commit/bf20bc07e3e3421d39eaacff052418ce26d791f2
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43770
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43770
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18151
web
Sources
- CVE List CVE-2025-43770
- GitHub Advisory GHSA-h4m4-xp33-37mj
- NVD CVE-2025-43770
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.