Moderate severityNVD Advisory· Published Aug 19, 2025· Updated Aug 19, 2025

CVE-2025-43737

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay:com.liferay.journal.webMaven	< 5.0.196	5.0.196

Affected products

ghsa-coords
pkg:maven/com.liferay/com.liferay.journal.web
Range: < 5.0.196
Liferay/Portalv5
Range: 7.4.3.132
Liferay/DXPcpe-rescue
Range: 2025.Q1.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vjwr-cqwf-6q96ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-43737ghsaADVISORY
github.com/liferay/liferay-portal/commit/eded63b8822923f9392d94ba1818beb63629b79fghsaWEB
liferay.atlassian.net/browse/LPE-18292ghsaWEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43737ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000