Moderate severityNVD Advisory· Published Aug 23, 2025· Updated Aug 25, 2025
CVE-2025-43767
CVE-2025-43767
Description
Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.info.implMaven | < 5.0.69 | 5.0.69 |
Affected products
2- Liferay/DXPv5Range: 7.4.13-u86
Patches
104d6892c12f8LPD-42066 Escape redirect url
1 file changed · +1 −1
modules/apps/info/info-impl/src/main/java/com/liferay/info/internal/request/struts/EditInfoItemStrutsAction.java+1 −1 modified@@ -400,7 +400,7 @@ else if (Validator.isNull(redirect)) { notificationText); } - httpServletResponse.sendRedirect(redirect); + httpServletResponse.sendRedirect(_portal.escapeRedirect(redirect)); return null; }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-6hj4-v2qp-cqr2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43767ghsaADVISORY
- github.com/liferay/liferay-portal/commit/04d6892c12f8c3d12085124b6cb856dfacb9bb89ghsaWEB
- liferay.atlassian.net/browse/LPE-18139ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43767ghsaWEB
News mentions
0No linked articles in our index yet.