Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-43770 · ADVISORY
• liferay/liferay-portal commit a712758 · WEB
• liferay/liferay-portal commit bf20bc0 · WEB
• liferay/liferay-portal · PACKAGE
• liferay.atlassian.net/browse/LPE-18151 · WEB
• liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43770 · WEB

Mais vulnerabilidades de com.liferay.portal:com.liferay.portal.kernel

• CVE-2025-43792MÉDIO 5.3Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.…
• CVE-2025-43793ALTO 7.5Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throu…
• CVE-2025-3526ALTO 7.5SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppo…
• CVE-2024-25607ALTO 7.5The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Life…
• CVE-2020-7961CRÍTICO 9.8EXPLOITED (CISA KEV)Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser…