CVE-2025-43817

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the redirect parameter to (1) Announcements, or (2) Alerts.

Published: Sep 30, 2025
Updated: Oct 1, 2025
CVE: CVE-2025-43817
GHSA: GHSA-m4hg-46pw-6mmv
Severity: Medium
Exploit:

No technical information available.

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
com.liferay.portal / release.portal.bom	7.4.3.74-ga74	7.4.3.112-ga112

https://github.com/liferay/liferay-portal/commit/40b9dcafccff4b0ba2a20ef4c9723bea820f814b
https://liferay.atlassian.net/browse/LPE-17902
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43817

Vulnerability Database

CVE-2025-43817

Deep Security Visibility Without the Complexity