VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Sep 29, 2025· Updated Sep 30, 2025

CVE-2025-43815

CVE-2025-43815

Description

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.product.navigation.control.menu.webMaven
>= 6.0.80, < 6.0.836.0.83

Affected products

2

Patches

1
30d07ef9c95c

LPS-206270 Escape the backURL

https://github.com/liferay/liferay-portalVictor GalanJan 16, 2024via ghsa
commit
1 file changed · +3 −1
  • modules/apps/product-navigation/product-navigation-control-menu-web/src/main/java/com/liferay/product/navigation/control/menu/web/internal/PortletBackLinkProductNavigationControlMenuEntry.java+3 −1 modified
    @@ -12,6 +12,7 @@
 import com.liferay.portal.kernel.service.ServiceContextThreadLocal;
 import com.liferay.portal.kernel.theme.PortletDisplay;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
+import com.liferay.portal.kernel.util.HtmlUtil;
 import com.liferay.portal.kernel.util.ParamUtil;
 import com.liferay.portal.kernel.util.Validator;
 import com.liferay.portal.kernel.util.WebKeys;
@@ -65,7 +66,8 @@ public String getLabel(Locale locale) {
 
 		if (Validator.isNotNull(urlBackTitle)) {
 			return _language.format(
-				locale, "go-to-x", new String[] {urlBackTitle});
+				locale, "go-to-x",
+				new String[] {HtmlUtil.escape(urlBackTitle)});
 		}
 
 		return _language.get(locale, "back");

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.