VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 23, 2025· Updated Aug 25, 2025

CVE-2025-43770

CVE-2025-43770

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:com.liferay.portal.kernelMaven
< 155.0.0155.0.0

Affected products

2

Patches

2
a712758b9c4b

LPD-44278: managed unusual but possible cases

https://github.com/liferay/liferay-portalMauro MariuzzoDec 30, 2024via ghsa
commit
2 files changed · +17 −4
  • portal-kernel/src/com/liferay/portal/kernel/util/HtmlUtil.java+12 −3 modified
    @@ -401,8 +401,17 @@ public static String escapeJSLink(String link) {
 
 		link = StringUtil.trim(link);
 
-		if (link.contains("javascript:")) {
-			link = StringUtil.replaceFirst(link, CharPool.COLON, "%3a");
+		int pos = link.indexOf(StringPool.COLON);
+
+		if (pos >= 10) {
+			String protocol = StringUtil.toLowerCase(
+				link.substring(pos-10, pos));
+
+			if ("javascript".equals(protocol)) {
+				return
+					link.substring(0, pos) + StringUtil.replaceFirst(
+						link.substring(pos), CharPool.COLON, "%3a");
+			}
 		}
 
 		return link;
@@ -915,4 +924,4 @@ private static int _stripTag(char[] tag, String text, int pos) {
 		_VALID_CHARS['_'] = true;
 	}
 
-}
\ No newline at end of file
+}
  • portal-kernel/test/unit/com/liferay/portal/kernel/util/HtmlUtilTest.java+5 −1 modified
    @@ -169,6 +169,10 @@ public void testEscapeJSLink() {
 		Assert.assertEquals(
 			"javascript%3aalert('hello');",
 			HtmlUtil.escapeJSLink("javascript:alert('hello');"));
+		Assert.assertEquals(
+			"http://localhost:8080/test?scope='javascript:;'",
+			HtmlUtil.escapeJSLink(
+				"http://localhost:8080/test?scope='javascript:;'"));
 	}
 
 	@Test
@@ -409,4 +413,4 @@ protected void assertUnchangedEscape(String input) {
 		Assert.assertEquals(input, HtmlUtil.escape(input));
 	}
 
-}
\ No newline at end of file
+}
bf20bc07e3e3

LPD-44278 Simplifly and prevent null byte injection

https://github.com/liferay/liferay-portalManuele CastroDec 20, 2024via ghsa
commit
1 file changed · +2 −6
  • portal-kernel/src/com/liferay/portal/kernel/util/HtmlUtil.java+2 −6 modified
    @@ -401,12 +401,8 @@ public static String escapeJSLink(String link) {
 
 		link = StringUtil.trim(link);
 
-		if (link.indexOf(StringPool.COLON) == 10) {
-			String protocol = StringUtil.toLowerCase(link.substring(0, 10));
-
-			if (protocol.equals("javascript")) {
-				link = StringUtil.replaceFirst(link, CharPool.COLON, "%3a");
-			}
+		if (link.contains("javascript:")) {
+			link = StringUtil.replaceFirst(link, CharPool.COLON, "%3a");
 		}
 
 		return link;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.