GitHub Advisoryadvisory · Maven

GHSA-wmjx-xv9v-r89q Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page

MEDIUM Published 2025-09-30 Modified 2025-09-30 Official page ↗
Aliases
CVE-2025-43815
Ecosystem
Maven
Packages
com.liferay:com.liferay.product.navigation.control.menu.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-09-30

Affected packages

• Maven com.liferay:com.liferay.product.navigation.control.menu.web: >= 6.0.80, < 6.0.83 → fixed in 6.0.83

Description

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

Related

Alias · CVE (1)

  • CVE-2025-43815 Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References