← CVE Intelligence

CVE-2025-43817

Liferay / Portal PUBLISHED

Description (CNA)

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.

Affected (CNA)

Vendor / productVersions
Liferay / Portalaffected 7.4.3.74 through 7.4.3.111
Liferay / DXPaffected 7.4.13-u74 through 7.4.13-u92; affected 2023.Q3.1 through 2023.Q3.8; affected 2023.Q4.0 through 2023.Q4.6

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.