GHSA-3h7r-4xxj-3mfm

Source

https://github.com/advisories/GHSA-3h7r-4xxj-3mfm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-3h7r-4xxj-3mfm/GHSA-3h7r-4xxj-3mfm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3h7r-4xxj-3mfm

Aliases

CVE-2025-43761

Published

2025-08-22T21:31:16Z

Modified

2025-08-25T18:44:34.008747Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

Details

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path

Database specific

{
    "nvd_published_at": "2025-08-22T21:15:31Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T18:28:02Z"
}

References

Affected packages

Maven / com.liferay:com.liferay.frontend.editor.ckeditor.web

Package

Name: com.liferay:com.liferay.frontend.editor.ckeditor.web; View open source insights on deps.dev
Purl: pkg:maven/com.liferay/com.liferay.frontend.editor.ckeditor.web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0.107

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

1.0.25

1.0.26

1.0.27

1.0.28

1.0.29

1.0.30

1.0.31

1.0.32

1.0.33

1.0.34

1.0.35

1.0.36

1.0.37

1.0.38

1.0.39

1.0.40

1.0.41

1.0.42

1.0.43

1.0.44

1.0.45

1.0.46

1.0.47

1.0.48

1.0.49

1.0.50

1.0.51

1.0.52

1.0.53

1.0.54

1.0.55

1.0.56

1.0.57

1.0.58

1.0.59

1.0.60

1.0.61

1.0.62

1.0.63

1.0.64

1.0.65

1.0.66

1.0.67

1.0.68

1.0.69

1.0.70

1.0.71

1.0.72

1.0.73

1.0.74

1.0.75

1.0.76

1.0.77

1.0.78

1.0.79

1.0.80

1.0.81

1.0.82

1.0.83

1.0.84

1.0.85

1.0.86

1.0.87

1.0.88

1.0.89

1.0.90

1.0.91

1.0.92

1.0.93

1.0.94

1.0.95

1.0.96

1.0.97

1.0.98

1.0.99

1.0.100

1.0.101

1.0.102

1.0.103

1.0.104

1.0.105

1.0.106

1.0.107

1.0.108

1.0.109

1.0.110

1.0.111

1.0.112

1.0.113

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.0.38

2.0.39

2.0.40

2.0.41

2.0.42

2.0.43

2.0.44

2.0.45

2.0.46

2.0.47

2.0.48

2.0.49

2.0.50

2.0.51

2.0.52

2.0.53

2.0.54

2.0.55

2.0.56

2.0.57

2.0.58

2.0.59

2.0.60

2.0.61

2.0.62

2.0.63

2.0.64

2.0.65

2.0.66

2.0.67

2.0.68

2.0.69

2.0.70

2.0.71

2.0.72

2.0.73

2.0.74

2.0.75

2.0.76

2.0.77

2.0.78

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.0.17

3.0.18

3.0.19

3.0.20

3.0.21

3.0.22

3.0.23

3.0.24

3.0.25

3.0.26

3.0.27

3.0.28

3.0.29

3.0.30

3.0.31

3.0.32

3.0.33

3.0.34

3.0.35

3.0.36

3.0.37

3.0.38

3.0.39

3.0.40

3.0.41

3.0.42

3.0.43

3.0.44

3.0.45

3.0.46

3.0.47

3.0.48

3.0.49

3.0.50

3.0.51

3.0.52

3.0.53

3.0.54

3.0.55

3.0.56

3.0.57

3.0.58

3.0.59

3.0.60

3.0.61

3.0.62

3.0.63

3.0.64

3.0.65

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.0.10

4.0.11

4.0.12

4.0.13

4.0.14

4.0.15

4.0.16

4.0.17

4.0.18

4.0.19

4.0.20

4.0.21

4.0.22

4.0.23

4.0.24

4.0.25

4.0.26

4.0.27

4.0.28

4.0.29

4.0.30

4.0.31

4.0.32

4.0.33

4.0.34

4.0.35

4.0.36

4.0.37

4.0.38

4.0.39

4.0.40

4.0.41

4.0.42

4.0.43

4.0.44

4.0.45

4.0.46

4.0.47

4.0.48

4.0.49

4.0.50

4.0.51

4.0.52

4.0.53

4.0.54

4.0.55

4.0.56

4.0.57

4.0.58

4.0.59

4.0.60

4.0.61

4.0.62

4.0.63

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10

5.0.11

5.0.12

5.0.13

5.0.14

5.0.15

5.0.16

5.0.17

5.0.18

5.0.19

5.0.20

5.0.21

5.0.22

5.0.23

5.0.24

5.0.25

5.0.26

5.0.27

5.0.28

5.0.29

5.0.30

5.0.31

5.0.32

5.0.33

5.0.34

5.0.35

5.0.36

5.0.37

5.0.38

5.0.39

5.0.40

5.0.41

5.0.42

5.0.43

5.0.44

5.0.45

5.0.46

5.0.47

5.0.48

5.0.49

5.0.50

5.0.51

5.0.52

5.0.53

5.0.54

5.0.55

5.0.56

5.0.57

5.0.58

5.0.59

5.0.60

5.0.61

5.0.62

5.0.63

5.0.64

5.0.65

5.0.66

5.0.67

5.0.68

5.0.69

5.0.70

5.0.71

5.0.72

5.0.73

5.0.74

5.0.75

5.0.76

5.0.77

5.0.78

5.0.79

5.0.80

5.0.81

5.0.82

5.0.83

5.0.84

5.0.85

5.0.86

5.0.87

5.0.88

5.0.89

5.0.90

5.0.91

5.0.92

5.0.93

5.0.94

5.0.95

5.0.96

5.0.97

5.0.98

5.0.99

5.0.100

5.0.101

5.0.102

5.0.103

5.0.104

5.0.105

5.0.106

Maven / com.liferay:com.liferay.frontend.js.dependencies.web

Package

Name: com.liferay:com.liferay.frontend.js.dependencies.web; View open source insights on deps.dev
Purl: pkg:maven/com.liferay/com.liferay.frontend.js.dependencies.web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.25

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

npm / liferay-ckeditor

Package

Name: liferay-ckeditor; View open source insights on deps.dev
Purl: pkg:npm/liferay-ckeditor

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.21.0-liferay.10