What is GHSA-rvmf-jw8g-r35r?

GHSA-rvmf-jw8g-r35r is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal vulnerable to Stored XSS in Components portlet

Which CVE IDs does GHSA-rvmf-jw8g-r35r cover?

GHSA-rvmf-jw8g-r35r covers the following CVE IDs: CVE-2025-43769. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-rvmf-jw8g-r35r?

GHSA-rvmf-jw8g-r35r affects 1 product, including: maven/com.liferay:com.liferay.plugins.admin.web:\u003c 5.0.36.

GHSA-rvmf-jw8g-r35rMedium

Liferay Portal vulnerable to Stored XSS in Components portlet

Vendor

GitHub Security Advisories

Published

August 23, 2025

Last Modified

August 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-43769 →

📋 Description

Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.

🎯 Affected products1

maven/com.liferay:com.liferay.plugins.admin.web:< 5.0.36

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43769
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43769
https://github.com/liferay/liferay-portal/commit/0249230a00a8ab42a5edaf6bca1bcf594525c0e9
https://liferay.atlassian.net/browse/LPE-18128
https://github.com/advisories/GHSA-rvmf-jw8g-r35r