Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

MEDIUM 6.1CVE-2025-43817 · GHSA-m4hg-46pw-6mmv · Published 29/09/2025 · updated 18/10/2026

In short

CVE-2025-43817 is a MEDIUM (CVSS 6.1) vulnerability affecting com.liferay.portal:release.portal.bom, digital experience platform (liferay), liferay portal (liferay).
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.4% of all vulnerabilities.
Fix: update to 7.4.3.112-ga112, 2023.Q4.7, 2023.q3.9, 7.4.3.112 or later.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bom Maven	`≥ 7.4.3.74-ga74, < 7.4.3.112-ga112`	`7.4.3.112-ga112`
digital experience platform liferay	`= 7.4≥ 2023.Q4.0, < 2023.Q4.7≥ 2023.q3.1, < 2023.q3.9`	`2023.Q4.72023.q3.9`
liferay portal liferay	`≥ 7.4.3.74, < 7.4.3.112`	`7.4.3.112`

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the redirect parameter to (1) Announcements, or (2) Alerts.

NVD description

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.

References

nvd.nist.gov/vuln/detail/CVE-2025-43817 · ADVISORY
liferay/liferay-portal commit 40b9dca · WEB
liferay/liferay-portal · PACKAGE
liferay.atlassian.net/browse/LPE-17902 · WEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43817 · WEB

More vulnerabilities in com.liferay.portal:release.portal.bom

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2025-43817 is a MEDIUM (CVSS 6.1) vulnerability affecting com.liferay.portal:release.portal.bom, digital experience platform (liferay), liferay portal (liferay).

Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.4% of all vulnerabilities.

Fix: update to 7.4.3.112-ga112, 2023.Q4.7, 2023.q3.9, 7.4.3.112 or later.

Package

Affected versions

Patched versions

com.liferay.portal:release.portal.bom

Maven

≥ 7.4.3.74-ga74, < 7.4.3.112-ga112

7.4.3.112-ga112

digital experience platform

liferay

= 7.4≥ 2023.Q4.0, < 2023.Q4.7≥ 2023.q3.1, < 2023.q3.9

2023.Q4.72023.q3.9

liferay portal

liferay

≥ 7.4.3.74, < 7.4.3.112

7.4.3.112

Description

NVD description

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.

More vulnerabilities in com.liferay.portal:release.portal.bom

See all →