CVE-2025-43767

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-43767
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43767.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-43767
Aliases
Published
2025-08-23T04:15:45.463Z
Modified
2026-07-09T17:04:21.050904Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Open Redirect vulnerability in /c/portal/editinfoitem parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "liferay:digital_experience_platform",
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2024.Q1.1"
                },
                {
                    "fixed": "2024.Q1.13"
                },
                {
                    "introduced": "2024.q2.0"
                },
                {
                    "last_affected": "2024.q2.13"
                },
                {
                    "introduced": "2024.Q3.1"
                },
                {
                    "fixed": "2024.Q3.10"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "vendor_product": "liferay:digital_experience_platform",
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.4-update86"
                },
                {
                    "last_affected": "7.4-update86"
                },
                {
                    "introduced": "7.4-update87"
                },
                {
                    "last_affected": "7.4-update87"
                },
                {
                    "introduced": "7.4-update88"
                },
                {
                    "last_affected": "7.4-update88"
                },
                {
                    "introduced": "7.4-update89"
                },
                {
                    "last_affected": "7.4-update89"
                },
                {
                    "introduced": "7.4-update90"
                },
                {
                    "last_affected": "7.4-update90"
                },
                {
                    "introduced": "7.4-update91"
                },
                {
                    "last_affected": "7.4-update91"
                },
                {
                    "introduced": "7.4-update92"
                },
                {
                    "last_affected": "7.4-update92"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
0f20ab121443b8c1e70c58285586d82ce48e7a8d
Fixed
a9017d1f654503189fcd6eecd59bd501a7015b8c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.3.86"
        },
        {
            "fixed": "7.4.3.132"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

vanir_signatures_modified 
"2026-07-09T17:04:21Z"
vanir_signatures 
[
    {
        "source": "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "103302773237074788461801313682446763330",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464",
                "202485877113214607873722865538960039931",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-43767-0b9fe555",
        "deprecated": false,
        "signature_type": "Line",
        "target": {
            "file": "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java"
        }
    },
    {
        "source": "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "signature_version": "v1",
        "digest": {
            "length": 2763.0,
            "function_hash": "170699539902466296749337177159259793854"
        },
        "id": "CVE-2025-43767-98b65317",
        "deprecated": false,
        "signature_type": "Function",
        "target": {
            "file": "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java",
            "function": "_upgradePortletPreferenceValues"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43767.json"