GitHub Advisoryadvisory · Maven

GHSA-6hj4-v2qp-cqr2 Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect

MEDIUM Published 2025-08-23 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43767
Ecosystem
Maven
Packages
com.liferay:com.liferay.info.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-601
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.info.impl: < 5.0.69 → fixed in 5.0.69

Description

Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

Related

Alias · CVE (1)

  • CVE-2025-43767 Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References