GHSA-wmjx-xv9v-r89q

Suggest an improvement
Source
https://github.com/advisories/GHSA-wmjx-xv9v-r89q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wmjx-xv9v-r89q/GHSA-wmjx-xv9v-r89q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wmjx-xv9v-r89q
Aliases
Published
2025-09-30T00:30:28Z
Modified
2025-09-30T20:27:32Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page
Details

Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5 allows remote attackers to inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-30T20:09:17Z",
    "nvd_published_at":  "2025-09-29T22:15:35Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / com.liferay:com.liferay.product.navigation.control.menu.web

Package

Name
com.liferay:com.liferay.product.navigation.control.menu.web
View open source insights on deps.dev
Purl
pkg:maven/com.liferay/com.liferay.product.navigation.control.menu.web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.80
Fixed
6.0.83

Affected versions

6.*
6.0.80
6.0.81
6.0.82

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wmjx-xv9v-r89q/GHSA-wmjx-xv9v-r89q.json"