GHSA-m4hg-46pw-6mmv

Source

https://github.com/advisories/GHSA-m4hg-46pw-6mmv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-m4hg-46pw-6mmv/GHSA-m4hg-46pw-6mmv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m4hg-46pw-6mmv

Aliases

CVE-2025-43817

Published

2025-09-30T00:30:28Z

Modified

2025-09-30T21:27:27.944293Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

Details

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the redirect parameter to (1) Announcements, or (2) Alerts.

Database specific

{
    "nvd_published_at": "2025-09-29T23:15:31Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-09-30T20:42:51Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name: com.liferay.portal:release.portal.bom; View open source insights on deps.dev
Purl: pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.4.3.74-ga74

Fixed

7.4.3.112-ga112

Affected versions

7.*

7.4.3.75

7.4.3.76

7.4.3.77

7.4.3.78

7.4.3.79

7.4.3.80

7.4.3.81

7.4.3.82

7.4.3.83

7.4.3.84

7.4.3.85

7.4.3.85-ga85

7.4.3.86

7.4.3.87

7.4.3.88

7.4.3.89

7.4.3.90

7.4.3.91

7.4.3.92

7.4.3.93

7.4.3.94

7.4.3.95

7.4.3.95-1

7.4.3.96

7.4.3.97

7.4.3.98

7.4.3.99

7.4.3.100

7.4.3.101

7.4.3.102

7.4.3.103

7.4.3.104

7.4.3.105

7.4.3.106

7.4.3.107

7.4.3.112

Database specific

last_known_affected_version_range

"<= 7.4.3.111-ga111"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-m4hg-46pw-6mmv/GHSA-m4hg-46pw-6mmv.json"