A reflected cross-site scripting (XSS) vulnerability exists in Liferay Portal 7.4.3.132 and Liferay DXP versions 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15. This vulnerability allows a remote authenticated user to inject JavaScript code via the _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter. Exploiting this vulnerability could lead to unauthorized actions being performed on behalf of the user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-43737 |
Exploitation
To exploit this vulnerability, an attacker must be a remote authenticated user who can manipulate the _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter. By injecting malicious JavaScript code into this parameter, the attacker can execute scripts in the context of the victim’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- Liferay Portal 7.4.3.132: A web platform for building digital experiences.
- Liferay DXP 2025.Q2.0 to 2025.Q2.8: A digital experience platform for creating and managing web applications.
- Liferay DXP 2025.Q1.0 to 2025.Q1.15: Earlier versions of the digital experience platform with the same vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or Liferay DXP that addresses this issue. Additionally, implementing input validation and sanitization for user inputs can help prevent XSS attacks.