GitHub Advisoryadvisory · Maven

GHSA-r45v-2289-jgr4 Liferay Portal has stored cross-site scripting (XSS) vulnerability

MEDIUM Published 2025-09-15 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43794
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-09-15

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 99.0.0 → fixed in 99.0.0

Description

A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers with the instance administrator role to inject arbitrary web script or HTML into all pages via a crafted payload injected into the Instance Configuration's (1) CDN Host HTTP text field or (2) CDN Host HTTPS text field.

Related

Alias · CVE (1)

  • CVE-2025-43794 Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References