GitHub Advisoryadvisory · Maven

GHSA-rvmf-jw8g-r35r Liferay Portal vulnerable to Stored XSS in Components portlet

MEDIUM Published 2025-08-23 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43769
Ecosystem
Maven
Packages
com.liferay:com.liferay.plugins.admin.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.plugins.admin.web: < 5.0.36 → fixed in 5.0.36

Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

Related

Alias · CVE (1)

  • CVE-2025-43769 Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References