What is GHSA-h8gx-4hhm-w45v?

GHSA-h8gx-4hhm-w45v is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal stored cross-site scripting in text field of the web content structure

Which CVE IDs does GHSA-h8gx-4hhm-w45v cover?

GHSA-h8gx-4hhm-w45v covers the following CVE IDs: CVE-2025-43765. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-h8gx-4hhm-w45v?

GHSA-h8gx-4hhm-w45v affects 1 product, including: maven/com.liferay:com.liferay.journal.service:\u003c 7.0.161.

GHSA-h8gx-4hhm-w45vMedium

Liferay Portal stored cross-site scripting in text field of the web content structure

Vendor

GitHub Security Advisories

Published

August 23, 2025

Last Modified

August 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-43765 →

📋 Description

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.

🎯 Affected products1

maven/com.liferay:com.liferay.journal.service:< 7.0.161

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43765
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43765
https://github.com/liferay/liferay-portal/commit/6aa0adb0e8d47794e942fd87074cf05755a2d9bc
https://liferay.atlassian.net/browse/LPE-18150
https://github.com/advisories/GHSA-h8gx-4hhm-w45v