Moderate severityNVD Advisory· Published Aug 19, 2025· Updated Aug 19, 2025
CVE-2025-43737
CVE-2025-43737
Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.journal.webMaven | < 5.0.196 | 5.0.196 |
Affected products
2- Liferay/DXPv5Range: 2025.Q1.0
Patches
1eded63b88229LPD-61587 Escape Redirect
1 file changed · +1 −1
modules/apps/journal/journal-web/src/main/resources/META-INF/resources/edit_article.jsp+1 −1 modified@@ -213,7 +213,7 @@ journalEditArticleDisplayContext.setViewAttributes(); <clay:link borderless="<%= true %>" displayType="secondary" - href="<%= journalEditArticleDisplayContext.getBackURL() %>" + href="<%= PortalUtil.escapeRedirect(journalEditArticleDisplayContext.getBackURL()) %>" label="cancel" type="button" />
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-vjwr-cqwf-6q96ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43737ghsaADVISORY
- github.com/liferay/liferay-portal/commit/eded63b8822923f9392d94ba1818beb63629b79fghsaWEB
- liferay.atlassian.net/browse/LPE-18292ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43737ghsaWEB
News mentions
0No linked articles in our index yet.