Moderate severityNVD Advisory· Published Aug 23, 2025· Updated Aug 25, 2025

CVE-2025-43767

Description

Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay:com.liferay.info.implMaven	< 5.0.69	5.0.69

Affected products

ghsa-coords
pkg:maven/com.liferay/com.liferay.info.impl
Range: < 5.0.69
Liferay/Portalv5
Range: 7.4.3.86
Liferay/DXPcpe-rescue
Range: 7.4.13-u86

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6hj4-v2qp-cqr2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-43767ghsaADVISORY
github.com/liferay/liferay-portal/commit/04d6892c12f8c3d12085124b6cb856dfacb9bb89ghsaWEB
liferay.atlassian.net/browse/LPE-18139ghsaWEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43767ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000