PT-2025-40048 · Maven · Com.Liferay.Portal:Release.Portal.Bom

Publicado 2025-09-30 · Atualizado 2025-09-30

OSV

CVSS v4.0

4.8

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the redirect parameter to (1) Announcements, or (2) Alerts.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

GHSA-M4HG-46PW-6MMV

Produtos afetados

Com.Liferay.Portal:Release.Portal.Bom

Referências · 6

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/40b9dcafccff4b0ba2a20ef4c9723bea820f814b · Nota
• https://osv.dev/vulnerability/GHSA-m4hg-46pw-6mmv · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43817 · Nota
• https://liferay.atlassian.net/browse/LPE-17902 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-43817 · Nota de Segurança