A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15. This vulnerability allows a remote authenticated user to inject JavaScript code via the _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43737 |
Exploitation
To exploit this vulnerability, an attacker must be a remote authenticated user who can manipulate the _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter. By crafting a malicious URL that includes JavaScript code, the attacker can execute arbitrary scripts in the context of the victim’s session, potentially leading to data theft or session hijacking.
Affected Products
- Liferay Portal 7.4.3.132 – A web platform for building digital experiences.
- Liferay DXP 2025.Q2.0 to 2025.Q2.8 – A digital experience platform for creating and managing web applications.
- Liferay DXP 2025.Q1.0 to 2025.Q1.15 – Earlier versions of the digital experience platform with the same vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or Liferay DXP that addresses this issue. Additionally, implementing input validation and sanitization for user inputs can help prevent XSS attacks.