CVE-2025-43760: XSS
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43760?
CVE-2025-43760 has been classified as a high-severity vulnerability due to its potential impact on affected systems.
How do I fix CVE-2025-43760?
To fix CVE-2025-43760, upgrade to the latest patched version of Liferay Portal or Liferay DXP immediately.
Which versions are affected by CVE-2025-43760?
CVE-2025-43760 affects Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.4, among others.
What type of vulnerability is CVE-2025-43760?
CVE-2025-43760 is a reflected cross-site scripting (XSS) vulnerability that can be exploited via user input.
How can CVE-2025-43760 impact my organization?
Exploitation of CVE-2025-43760 may lead to unauthorized actions being performed in the context of the affected user's session.