What is GHSA-vjwr-cqwf-6q96?

GHSA-vjwr-cqwf-6q96 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

Which CVE IDs does GHSA-vjwr-cqwf-6q96 cover?

GHSA-vjwr-cqwf-6q96 covers the following CVE IDs: CVE-2025-43737. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-vjwr-cqwf-6q96?

GHSA-vjwr-cqwf-6q96 affects 1 product, including: maven/com.liferay:com.liferay.journal.web:\u003c 5.0.196.

GHSA-vjwr-cqwf-6q96Medium

Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

Vendor

GitHub Security Advisories

Published

August 19, 2025

Last Modified

August 20, 2025

🔗 CVE IDs covered (1)

CVE-2025-43737 →

📋 Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

🎯 Affected products1

maven/com.liferay:com.liferay.journal.web:< 5.0.196

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43737
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43737
https://github.com/liferay/liferay-portal/commit/eded63b8822923f9392d94ba1818beb63629b79f
https://liferay.atlassian.net/browse/LPE-18292
https://github.com/advisories/GHSA-vjwr-cqwf-6q96