GHSA-h4m4-xp33-37mj

Suggest an improvement
Source
https://github.com/advisories/GHSA-h4m4-xp33-37mj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-h4m4-xp33-37mj/GHSA-h4m4-xp33-37mj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h4m4-xp33-37mj
Aliases
  • CVE-2025-43770
Published
2025-08-23T03:30:43Z
Modified
2025-08-25T18:44:34.075261Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter
Details

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.

Database specific 
{
    "nvd_published_at": "2025-08-23T02:15:28Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T18:27:54Z"
}
References

Affected packages

Maven / com.liferay.portal:com.liferay.portal.kernel

Package

Name
com.liferay.portal:com.liferay.portal.kernel
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/com.liferay.portal.kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
155.0.0

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.0.3

2.*

2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.17.0
2.18.0
2.19.0
2.20.0
2.21.0
2.22.0
2.23.0
2.24.0
2.25.0
2.26.0
2.27.0
2.28.0
2.29.0
2.30.0
2.31.0
2.32.0
2.33.0
2.34.0
2.35.0
2.36.0
2.37.0
2.38.0
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.44.0
2.45.0
2.46.0
2.47.0
2.48.0
2.49.0
2.50.0
2.51.0
2.52.0
2.53.0
2.54.0
2.55.0
2.55.1
2.56.0
2.57.0
2.58.0
2.58.1
2.58.2
2.59.0
2.60.0
2.61.0
2.61.1
2.61.2
2.61.3
2.62.0
2.63.0
2.63.1
2.64.0
2.64.1
2.65.0
2.66.0
2.68.0
2.69.0
2.70.0
2.71.0
2.72.0
2.73.0
2.74.0
2.75.0
2.75.1
2.76.0
2.76.1
2.77.0
2.78.0
2.79.0
2.79.1
2.79.2
2.80.0
2.80.1
2.81.0
2.81.1
2.81.2
2.82.0
2.83.0
2.84.0
2.84.1
2.85.0
2.86.0
2.86.1
2.87.0
2.87.1
2.87.2
2.88.0
2.89.0
2.89.1
2.90.0
2.90.1
2.90.2
2.91.0
2.92.0
2.92.1
2.93.0
2.94.0
2.94.1
2.94.2
2.94.3
2.95.0
2.95.1
2.96.0
2.97.0
2.98.0
2.98.1
2.99.0
2.99.1
2.99.2
2.100.0
2.101.0
2.102.0
2.103.0
2.103.1
2.104.0
2.105.0
2.105.1
2.105.2
2.106.0
2.107.0
2.108.0
2.109.0
2.109.1
2.110.0
2.111.0
2.111.1
2.111.2
2.112.0
2.113.0
2.113.1
2.113.2
2.114.0
2.115.0
2.116.0
2.116.1
2.117.0
2.118.0
2.119.0
2.119.1
2.120.0
2.120.1
2.121.0
2.122.0
2.123.0
2.123.1
2.124.0
2.125.0
2.125.1
2.126.0
2.126.1
2.126.2
2.127.0
2.128.0
2.128.1
2.128.2
2.128.3
2.129.0
2.130.0
2.130.1
2.131.0
2.131.1
2.132.0
2.132.1
2.132.2
2.132.3
2.132.4
2.133.0
2.134.0
2.135.0
2.135.1
2.136.0
2.136.1
2.137.0
2.138.0
2.138.1
2.138.2
2.139.0
2.140.0
2.140.1
2.140.2
2.140.3
2.140.4
2.141.0
2.141.1
2.141.2
2.142.0
2.143.0
2.143.1
2.144.0
2.144.1
2.144.2
2.144.3
2.145.0
2.146.0
2.146.1
2.146.2
2.147.0
2.147.1
2.147.2
2.147.3
2.147.4
2.147.5
2.148.0
2.148.1
2.148.2
2.148.3
2.149.0
2.150.0
2.150.1
2.150.2
2.150.3
2.150.4
2.151.0
2.152.0
2.152.1
2.153.0
2.154.0
2.154.1
2.154.2
2.154.3
2.155.0
2.157.0
2.158.0

3.*

3.0.0
3.0.1
3.1.0
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.5.0
3.5.1
3.5.2
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.8.0
3.9.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.16.0
3.17.0
3.17.1
3.18.0
3.18.1
3.18.2
3.18.3
3.18.4
3.19.0
3.20.0
3.20.1
3.21.0
3.21.1
3.21.2
3.22.0
3.23.0
3.24.0
3.25.0
3.26.0
3.27.0
3.28.0
3.29.0
3.30.0
3.31.0
3.31.1
3.31.2
3.32.0
3.32.1
3.32.2
3.32.3
3.32.4
3.33.0
3.33.1
3.34.0
3.34.1
3.34.2
3.35.0
3.35.1
3.35.2
3.35.3
3.35.4
3.35.5
3.35.6
3.36.0
3.37.0
3.37.1
3.38.0
3.39.0
3.39.1
3.39.2
3.40.0
3.40.1
3.41.0
3.41.1
3.41.2
3.41.3
3.41.4
3.41.5
3.42.0
3.42.1
3.42.2
3.42.3
3.42.4
3.42.5
3.43.0
3.43.1
3.44.0
3.45.0
3.46.0
3.46.1
3.46.2
3.46.3
3.47.0
3.47.1
3.48.0
3.48.1
3.48.2
3.48.3
3.49.0
3.49.1
3.49.2
3.49.3
3.50.0
3.50.1
3.51.0
3.52.0
3.53.0
3.53.1
3.53.2
3.53.3
3.54.0
3.55.0
3.56.0
3.57.0
3.58.0
3.59.0
3.60.0
3.61.0
3.62.0
3.63.0
3.63.1
3.64.0
3.64.1
3.64.2
3.65.0
3.65.1
3.65.2
3.65.3
3.65.4
3.66.0
3.66.1
3.67.0
3.68.0
3.69.0
3.70.0
3.71.0
3.72.0
3.73.0
3.73.1
3.74.0
3.75.0
3.75.1
3.75.2
3.76.0
3.77.0
3.78.0
3.78.1
3.78.2
3.79.0
3.80.0
3.81.0
3.81.1
3.82.0
3.82.1
3.82.2
3.83.0
3.83.1
3.84.0
3.85.0
3.85.1
3.85.2
3.86.0
3.87.0
3.88.0
3.88.1
3.88.2
3.89.0
3.89.1
3.89.2
3.89.3
3.89.4
3.90.0
3.90.1
3.91.0
3.92.0
3.92.1
3.92.2
3.93.0
3.94.0
3.94.1
3.95.0
3.96.0
3.97.0
3.97.1
3.97.2
3.97.3
3.97.4
3.98.0
3.98.1
3.98.2
3.99.0
3.100.0
3.101.0
3.102.0
3.102.1
3.102.2
3.103.0
3.104.0
3.104.1
3.105.0
3.105.1
3.106.0
3.106.1
3.107.0
3.107.1
3.107.2
3.108.0
3.109.0
3.109.1
3.110.0
3.111.0
3.112.0
3.112.1
3.112.2
3.112.3
3.112.4
3.113.0
3.114.0
3.114.1
3.115.0
3.116.0
3.117.0
3.117.1
3.117.2
3.118.0
3.119.0
3.119.1
3.119.2
3.120.0
3.120.1
3.120.2
3.121.0
3.122.0
3.123.0
3.124.0
3.125.0
3.126.0
3.126.1
3.126.2
3.126.3
3.126.4
3.126.5
3.128.0
3.129.0
3.129.1
3.130.0
3.131.0
3.132.0
3.132.1

4.*

4.0.0
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.5.0
4.6.0
4.7.0
4.7.1
4.8.0
4.9.0
4.10.0
4.11.0
4.11.1
4.12.0
4.13.0
4.13.1
4.14.0
4.15.0
4.16.0
4.16.1
4.16.2
4.16.3
4.17.0
4.18.0
4.19.0
4.20.0
4.21.0
4.22.0
4.23.0
4.24.0
4.25.0
4.25.1
4.25.2
4.26.0
4.27.0
4.27.1
4.28.0
4.29.0
4.30.0
4.31.0
4.31.1
4.32.0
4.32.1
4.32.2
4.32.3
4.33.0
4.33.1
4.34.0
4.35.0
4.35.1
4.35.2
4.35.3
4.36.0
4.37.0
4.38.0
4.38.1
4.38.2
4.39.0
4.39.1
4.39.2
4.40.0
4.40.1
4.41.0
4.42.0
4.42.1
4.45.0
4.45.1
4.46.0
4.46.1
4.47.0
4.48.0
4.48.1
4.49.0
4.49.1
4.50.0
4.51.0
4.51.1
4.52.0
4.52.1
4.53.0
4.54.0
4.55.0
4.56.0
4.57.0
4.57.1
4.57.2
4.57.3
4.58.0
4.59.0
4.59.1
4.60.0
4.60.1
4.61.0
4.62.0
4.63.0
4.64.0
4.64.1
4.64.2
4.64.3
4.65.0
4.66.0
4.66.1
4.66.2
4.66.3
4.67.0
4.68.0
4.69.0
4.69.1
4.69.2
4.70.0
4.70.1
4.70.2
4.71.0
4.71.1
4.72.0
4.73.0
4.74.0
4.74.1
4.75.0
4.75.1
4.75.2
4.75.3
4.76.0
4.77.0
4.77.1
4.77.2
4.78.0
4.78.1
4.78.2
4.78.3
4.79.0
4.79.1
4.79.2
4.79.3
4.79.4
4.79.5
4.80.0
4.81.0
4.81.1
4.81.2
4.82.0
4.82.1
4.82.2
4.83.0
4.84.0
4.84.1
4.85.0
4.85.1
4.86.0
4.87.0
4.87.1
4.88.0
4.89.0
4.89.1
4.90.0
4.91.0
4.91.1
4.91.2
4.91.3
4.92.0
4.93.0
4.94.0
4.95.0
4.95.1
4.95.2
4.95.3
4.96.0
4.97.0
4.98.0
4.99.0
4.100.0
4.100.1
4.101.0
4.103.0
4.104.0
4.105.0
4.106.0

5.*

5.0.0
5.0.1
5.1.0
5.1.1
5.2.0
5.2.1
5.2.2
5.3.0
5.4.0

6.*

6.0.0
6.1.0
6.1.1
6.2.0
6.2.1
6.3.0
6.4.0
6.5.0
6.6.0
6.7.0
6.8.0
6.9.0
6.9.1
6.9.2
6.10.0
6.10.1

7.*

7.0.0
7.1.0
7.2.0
7.3.0

8.*

8.0.0
8.0.1
8.1.0

9.*

9.0.0
9.0.1
9.0.2
9.0.3
9.1.0
9.1.1
9.1.2
9.2.0
9.2.1
9.2.2
9.2.3
9.3.0
9.4.0
9.4.1
9.4.2
9.5.0
9.5.1
9.5.2
9.6.0
9.7.0
9.8.0
9.8.1
9.9.0
9.10.0
9.11.0
9.11.1
9.12.0
9.12.1
9.12.2
9.12.3
9.13.0
9.13.1
9.13.2
9.13.3
9.13.4
9.14.0
9.15.0
9.16.0
9.16.1
9.17.0
9.18.0
9.19.0
9.20.0
9.21.0
9.22.0
9.23.0
9.23.1
9.23.2
9.24.0
9.25.0
9.26.0
9.27.0
9.27.1
9.28.0
9.28.1
9.29.0
9.30.0
9.31.0
9.32.0
9.32.1
9.33.0
9.33.1
9.33.2
9.34.0
9.34.1
9.35.0
9.35.1
9.35.2
9.36.0
9.37.0
9.38.0
9.39.0
9.40.0
9.41.0
9.42.0
9.43.0
9.43.1
9.43.2
9.43.3
9.43.4
9.43.5
9.44.0
9.45.0
9.46.0
9.46.1
9.47.0
9.48.0
9.50.0
9.50.1
9.52.0
9.53.0
9.53.1
9.54.0
9.55.0
9.56.0
9.56.1
9.56.2
9.57.0
9.57.1
9.57.2
9.58.0
9.58.1
9.59.0
9.59.1
9.59.2
9.60.0
9.60.1
9.60.2
9.61.0
9.62.0
9.63.0
9.64.0
9.64.1
9.65.0
9.66.0
9.67.0
9.67.1
9.68.0
9.69.0
9.70.0
9.72.0
9.73.0
9.73.1
9.74.0
9.75.0
9.76.0
9.77.0
9.77.1
9.78.0
9.78.1
9.79.0
9.79.1
9.80.0
9.81.0
9.82.0
9.82.1
9.83.0
9.84.0
9.85.0
9.86.0
9.87.0
9.88.0

10.*

10.0.0
10.0.1
10.0.2
10.1.0
10.1.1
10.1.2
10.2.0
10.2.1
10.2.2
10.2.3
10.3.0
10.3.1
10.4.0
10.5.0
10.5.1
10.6.0
10.6.1
10.6.2

11.*

11.0.0
11.0.1
11.0.2
11.0.3
11.1.0
11.1.1
11.2.0
11.3.0
11.3.1
11.4.0
11.5.0
11.6.0
11.7.0
11.8.0

12.*

12.0.0
12.1.0
12.2.0
12.2.1

13.*

13.0.0
13.1.0
13.2.0
13.3.0
13.3.1

14.*

14.0.0

15.*

15.0.0

16.*

16.0.0
16.0.1
16.1.0
16.2.0
16.2.1
16.3.0

17.*

17.0.0
17.1.0

18.*

18.0.0
18.0.1

19.*

19.0.0
19.0.1

20.*

20.0.0
20.0.1
20.1.0

21.*

21.0.0
21.1.0

22.*

22.0.0

23.*

23.0.0

24.*

24.0.0
24.1.0

25.*

25.0.0

26.*

26.0.0

27.*

27.0.0

28.*

28.0.0

29.*

29.0.0

30.*

30.0.0
30.0.1
30.1.0

31.*

31.0.0
31.1.0

32.*

32.0.0

33.*

33.0.0

34.*

34.0.0

35.*

35.0.0

36.*

36.0.0

37.*

37.0.0

38.*

38.0.0

39.*

39.0.0

40.*

40.0.0

41.*

41.0.0
41.1.0
41.2.0

42.*

42.0.0

43.*

43.0.0
43.0.1

44.*

44.0.0
44.1.0

45.*

45.0.0
45.0.1

46.*

46.0.0
46.0.1

47.*

47.0.0
47.1.0

48.*

48.0.0

49.*

49.0.0

50.*

50.0.0
50.0.1

51.*

51.0.0
51.0.1

52.*

52.0.0
52.1.0

53.*

53.0.0
53.0.1

54.*

54.0.0

55.*

55.0.0
55.1.0

56.*

56.0.0
56.0.1

57.*

57.0.0
57.1.0

58.*

58.0.0

59.*

59.0.0

60.*

60.0.0
60.1.0

61.*

61.0.0
61.1.0

62.*

62.0.0

63.*

63.0.0
63.1.0

64.*

64.0.0

65.*

65.0.0
65.0.1

66.*

66.0.0

67.*

67.0.0
67.0.1

68.*

68.0.0

69.*

69.0.0

70.*

70.0.0

71.*

71.0.0

72.*

72.0.0

73.*

73.0.0

74.*

74.1.0

76.*

76.0.0

77.*

77.0.0

78.*

78.0.0
78.1.0

79.*

79.0.0
79.0.1

80.*

80.0.0

81.*

81.0.0

82.*

82.0.0

83.*

83.0.0

84.*

84.0.0

85.*

85.0.0

86.*

86.0.0

87.*

87.0.0
87.1.0

88.*

88.0.0

89.*

89.0.0

90.*

90.0.0

91.*

91.0.0

92.*

92.1.0
92.2.0

93.*

93.0.0

94.*

94.0.0

95.*

95.0.0
95.1.0

96.*

96.0.0
96.0.1

97.*

97.0.0

98.*

98.0.0

99.*

99.0.0

100.*

100.0.0
100.1.0
100.1.1

101.*

101.0.0

102.*

102.0.0
102.1.0

103.*

103.0.0
103.0.1

104.*

104.0.0

105.*

105.0.0
105.1.0

106.*

106.0.0

107.*

107.0.0
107.1.0

108.*

108.0.0

109.*

109.0.0

110.*

110.0.0

111.*

111.0.0

112.*

112.0.0

113.*

113.0.0

114.*

114.0.0
114.0.1

115.*

115.0.0

116.*

116.0.0

117.*

117.0.0

118.*

118.0.0

119.*

119.0.0

120.*

120.1.0
120.2.0

121.*

121.0.0

123.*

123.0.0

124.*

124.1.0
124.2.0
124.2.1
124.2.2

125.*

125.0.0

126.*

126.0.0
126.0.1

127.*

127.0.0

128.*

128.0.1

129.*

129.1.0

130.*

130.0.0
130.0.1

131.*

131.0.0

132.*

132.0.0
132.0.1

133.*

133.0.0

134.*

134.0.0

135.*

135.0.0

136.*

136.1.0

137.*

137.1.0

138.*

138.0.0

139.*

139.0.0

140.*

140.0.0

141.*

141.0.0

142.*

142.0.0

143.*

143.1.0

144.*

144.0.0

145.*

145.0.0

146.*

146.0.0
146.0.1

147.*

147.0.0
147.1.0

148.*

148.0.0

149.*

149.0.0

150.*

150.0.0

151.*

151.0.0

152.*

152.0.0

153.*

153.0.0

154.*

154.0.0