{"id":"GHSA-h4m4-xp33-37mj","summary":"Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter","details":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92  allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.","aliases":["CVE-2025-43770"],"modified":"2025-08-25T18:44:34.075261Z","published":"2025-08-23T03:30:43Z","database_specific":{"github_reviewed_at":"2025-08-25T18:27:54Z","nvd_published_at":"2025-08-23T02:15:28Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43770"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/a712758b9c4b6f4c54df5dec7d334279bb30f75a"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/bf20bc07e3e3421d39eaacff052418ce26d791f2"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-18151"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43770"}],"affected":[{"package":{"name":"com.liferay.portal:com.liferay.portal.kernel","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/com.liferay.portal.kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"155.0.0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","10.0.0","10.0.1","10.0.2","10.1.0","10.1.1","10.1.2","10.2.0","10.2.1","10.2.2","10.2.3","10.3.0","10.3.1","10.4.0","10.5.0","10.5.1","10.6.0","10.6.1","10.6.2","100.0.0","100.1.0","100.1.1","101.0.0","102.0.0","102.1.0","103.0.0","103.0.1","104.0.0","105.0.0","105.1.0","106.0.0","107.0.0","107.1.0","108.0.0","109.0.0","11.0.0","11.0.1","11.0.2","11.0.3","11.1.0","11.1.1","11.2.0","11.3.0","11.3.1","11.4.0","11.5.0","11.6.0","11.7.0","11.8.0","110.0.0","111.0.0","112.0.0","113.0.0","114.0.0","114.0.1","115.0.0","116.0.0","117.0.0","118.0.0","119.0.0","12.0.0","12.1.0","12.2.0","12.2.1","120.1.0","120.2.0","121.0.0","123.0.0","124.1.0","124.2.0","124.2.1","124.2.2","125.0.0","126.0.0","126.0.1","127.0.0","128.0.1","129.1.0","13.0.0","13.1.0","13.2.0","13.3.0","13.3.1","130.0.0","130.0.1","131.0.0","132.0.0","132.0.1","133.0.0","134.0.0","135.0.0","136.1.0","137.1.0","138.0.0","139.0.0","14.0.0","140.0.0","141.0.0","142.0.0","143.1.0","144.0.0","145.0.0","146.0.0","146.0.1","147.0.0","147.1.0","148.0.0","149.0.0","15.0.0","150.0.0","151.0.0","152.0.0","153.0.0","154.0.0","16.0.0","16.0.1","16.1.0","16.2.0","16.2.1","16.3.0","17.0.0","17.1.0","18.0.0","18.0.1","19.0.0","19.0.1","2.0.0","2.1.0","2.10.0","2.100.0","2.101.0","2.102.0","2.103.0","2.103.1","2.104.0","2.105.0","2.105.1","2.105.2","2.106.0","2.107.0","2.108.0","2.109.0","2.109.1","2.11.0","2.110.0","2.111.0","2.111.1","2.111.2","2.112.0","2.113.0","2.113.1","2.113.2","2.114.0","2.115.0","2.116.0","2.116.1","2.117.0","2.118.0","2.119.0","2.119.1","2.12.0","2.120.0","2.120.1","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.125.1","2.126.0","2.126.1","2.126.2","2.127.0","2.128.0","2.128.1","2.128.2","2.128.3","2.129.0","2.13.0","2.130.0","2.130.1","2.131.0","2.131.1","2.132.0","2.132.1","2.132.2","2.132.3","2.132.4","2.133.0","2.134.0","2.135.0","2.135.1","2.136.0","2.136.1","2.137.0","2.138.0","2.138.1","2.138.2","2.139.0","2.14.0","2.140.0","2.140.1","2.140.2","2.140.3","2.140.4","2.141.0","2.141.1","2.141.2","2.142.0","2.143.0","2.143.1","2.144.0","2.144.1","2.144.2","2.144.3","2.145.0","2.146.0","2.146.1","2.146.2","2.147.0","2.147.1","2.147.2","2.147.3","2.147.4","2.147.5","2.148.0","2.148.1","2.148.2","2.148.3","2.149.0","2.15.0","2.150.0","2.150.1","2.150.2","2.150.3","2.150.4","2.151.0","2.152.0","2.152.1","2.153.0","2.154.0","2.154.1","2.154.2","2.154.3","2.155.0","2.157.0","2.158.0","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.20.0","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.26.0","2.27.0","2.28.0","2.29.0","2.3.0","2.30.0","2.31.0","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.37.0","2.38.0","2.39.0","2.4.0","2.40.0","2.41.0","2.42.0","2.43.0","2.44.0","2.45.0","2.46.0","2.47.0","2.48.0","2.49.0","2.5.0","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.55.0","2.55.1","2.56.0","2.57.0","2.58.0","2.58.1","2.58.2","2.59.0","2.6.0","2.60.0","2.61.0","2.61.1","2.61.2","2.61.3","2.62.0","2.63.0","2.63.1","2.64.0","2.64.1","2.65.0","2.66.0","2.68.0","2.69.0","2.7.0","2.70.0","2.71.0","2.72.0","2.73.0","2.74.0","2.75.0","2.75.1","2.76.0","2.76.1","2.77.0","2.78.0","2.79.0","2.79.1","2.79.2","2.8.0","2.80.0","2.80.1","2.81.0","2.81.1","2.81.2","2.82.0","2.83.0","2.84.0","2.84.1","2.85.0","2.86.0","2.86.1","2.87.0","2.87.1","2.87.2","2.88.0","2.89.0","2.89.1","2.9.0","2.90.0","2.90.1","2.90.2","2.91.0","2.92.0","2.92.1","2.93.0","2.94.0","2.94.1","2.94.2","2.94.3","2.95.0","2.95.1","2.96.0","2.97.0","2.98.0","2.98.1","2.99.0","2.99.1","2.99.2","20.0.0","20.0.1","20.1.0","21.0.0","21.1.0","22.0.0","23.0.0","24.0.0","24.1.0","25.0.0","26.0.0","27.0.0","28.0.0","29.0.0","3.0.0","3.0.1","3.1.0","3.10.0","3.100.0","3.101.0","3.102.0","3.102.1","3.102.2","3.103.0","3.104.0","3.104.1","3.105.0","3.105.1","3.106.0","3.106.1","3.107.0","3.107.1","3.107.2","3.108.0","3.109.0","3.109.1","3.11.0","3.110.0","3.111.0","3.112.0","3.112.1","3.112.2","3.112.3","3.112.4","3.113.0","3.114.0","3.114.1","3.115.0","3.116.0","3.117.0","3.117.1","3.117.2","3.118.0","3.119.0","3.119.1","3.119.2","3.12.0","3.120.0","3.120.1","3.120.2","3.121.0","3.122.0","3.123.0","3.124.0","3.125.0","3.126.0","3.126.1","3.126.2","3.126.3","3.126.4","3.126.5","3.128.0","3.129.0","3.129.1","3.13.0","3.13.1","3.130.0","3.131.0","3.132.0","3.132.1","3.14.0","3.15.0","3.15.1","3.16.0","3.17.0","3.17.1","3.18.0","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.2.0","3.2.1","3.2.2","3.20.0","3.20.1","3.21.0","3.21.1","3.21.2","3.22.0","3.23.0","3.24.0","3.25.0","3.26.0","3.27.0","3.28.0","3.29.0","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.30.0","3.31.0","3.31.1","3.31.2","3.32.0","3.32.1","3.32.2","3.32.3","3.32.4","3.33.0","3.33.1","3.34.0","3.34.1","3.34.2","3.35.0","3.35.1","3.35.2","3.35.3","3.35.4","3.35.5","3.35.6","3.36.0","3.37.0","3.37.1","3.38.0","3.39.0","3.39.1","3.39.2","3.4.0","3.40.0","3.40.1","3.41.0","3.41.1","3.41.2","3.41.3","3.41.4","3.41.5","3.42.0","3.42.1","3.42.2","3.42.3","3.42.4","3.42.5","3.43.0","3.43.1","3.44.0","3.45.0","3.46.0","3.46.1","3.46.2","3.46.3","3.47.0","3.47.1","3.48.0","3.48.1","3.48.2","3.48.3","3.49.0","3.49.1","3.49.2","3.49.3","3.5.0","3.5.1","3.5.2","3.50.0","3.50.1","3.51.0","3.52.0","3.53.0","3.53.1","3.53.2","3.53.3","3.54.0","3.55.0","3.56.0","3.57.0","3.58.0","3.59.0","3.6.0","3.6.1","3.6.2","3.60.0","3.61.0","3.62.0","3.63.0","3.63.1","3.64.0","3.64.1","3.64.2","3.65.0","3.65.1","3.65.2","3.65.3","3.65.4","3.66.0","3.66.1","3.67.0","3.68.0","3.69.0","3.7.0","3.7.1","3.70.0","3.71.0","3.72.0","3.73.0","3.73.1","3.74.0","3.75.0","3.75.1","3.75.2","3.76.0","3.77.0","3.78.0","3.78.1","3.78.2","3.79.0","3.8.0","3.80.0","3.81.0","3.81.1","3.82.0","3.82.1","3.82.2","3.83.0","3.83.1","3.84.0","3.85.0","3.85.1","3.85.2","3.86.0","3.87.0","3.88.0","3.88.1","3.88.2","3.89.0","3.89.1","3.89.2","3.89.3","3.89.4","3.9.0","3.90.0","3.90.1","3.91.0","3.92.0","3.92.1","3.92.2","3.93.0","3.94.0","3.94.1","3.95.0","3.96.0","3.97.0","3.97.1","3.97.2","3.97.3","3.97.4","3.98.0","3.98.1","3.98.2","3.99.0","30.0.0","30.0.1","30.1.0","31.0.0","31.1.0","32.0.0","33.0.0","34.0.0","35.0.0","36.0.0","37.0.0","38.0.0","39.0.0","4.0.0","4.1.0","4.10.0","4.100.0","4.100.1","4.101.0","4.103.0","4.104.0","4.105.0","4.106.0","4.11.0","4.11.1","4.12.0","4.13.0","4.13.1","4.14.0","4.15.0","4.16.0","4.16.1","4.16.2","4.16.3","4.17.0","4.18.0","4.19.0","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.20.0","4.21.0","4.22.0","4.23.0","4.24.0","4.25.0","4.25.1","4.25.2","4.26.0","4.27.0","4.27.1","4.28.0","4.29.0","4.3.0","4.30.0","4.31.0","4.31.1","4.32.0","4.32.1","4.32.2","4.32.3","4.33.0","4.33.1","4.34.0","4.35.0","4.35.1","4.35.2","4.35.3","4.36.0","4.37.0","4.38.0","4.38.1","4.38.2","4.39.0","4.39.1","4.39.2","4.4.0","4.4.1","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.40.0","4.40.1","4.41.0","4.42.0","4.42.1","4.45.0","4.45.1","4.46.0","4.46.1","4.47.0","4.48.0","4.48.1","4.49.0","4.49.1","4.5.0","4.50.0","4.51.0","4.51.1","4.52.0","4.52.1","4.53.0","4.54.0","4.55.0","4.56.0","4.57.0","4.57.1","4.57.2","4.57.3","4.58.0","4.59.0","4.59.1","4.6.0","4.60.0","4.60.1","4.61.0","4.62.0","4.63.0","4.64.0","4.64.1","4.64.2","4.64.3","4.65.0","4.66.0","4.66.1","4.66.2","4.66.3","4.67.0","4.68.0","4.69.0","4.69.1","4.69.2","4.7.0","4.7.1","4.70.0","4.70.1","4.70.2","4.71.0","4.71.1","4.72.0","4.73.0","4.74.0","4.74.1","4.75.0","4.75.1","4.75.2","4.75.3","4.76.0","4.77.0","4.77.1","4.77.2","4.78.0","4.78.1","4.78.2","4.78.3","4.79.0","4.79.1","4.79.2","4.79.3","4.79.4","4.79.5","4.8.0","4.80.0","4.81.0","4.81.1","4.81.2","4.82.0","4.82.1","4.82.2","4.83.0","4.84.0","4.84.1","4.85.0","4.85.1","4.86.0","4.87.0","4.87.1","4.88.0","4.89.0","4.89.1","4.9.0","4.90.0","4.91.0","4.91.1","4.91.2","4.91.3","4.92.0","4.93.0","4.94.0","4.95.0","4.95.1","4.95.2","4.95.3","4.96.0","4.97.0","4.98.0","4.99.0","40.0.0","41.0.0","41.1.0","41.2.0","42.0.0","43.0.0","43.0.1","44.0.0","44.1.0","45.0.0","45.0.1","46.0.0","46.0.1","47.0.0","47.1.0","48.0.0","49.0.0","5.0.0","5.0.1","5.1.0","5.1.1","5.2.0","5.2.1","5.2.2","5.3.0","5.4.0","50.0.0","50.0.1","51.0.0","51.0.1","52.0.0","52.1.0","53.0.0","53.0.1","54.0.0","55.0.0","55.1.0","56.0.0","56.0.1","57.0.0","57.1.0","58.0.0","59.0.0","6.0.0","6.1.0","6.1.1","6.10.0","6.10.1","6.2.0","6.2.1","6.3.0","6.4.0","6.5.0","6.6.0","6.7.0","6.8.0","6.9.0","6.9.1","6.9.2","60.0.0","60.1.0","61.0.0","61.1.0","62.0.0","63.0.0","63.1.0","64.0.0","65.0.0","65.0.1","66.0.0","67.0.0","67.0.1","68.0.0","69.0.0","7.0.0","7.1.0","7.2.0","7.3.0","70.0.0","71.0.0","72.0.0","73.0.0","74.1.0","76.0.0","77.0.0","78.0.0","78.1.0","79.0.0","79.0.1","8.0.0","8.0.1","8.1.0","80.0.0","81.0.0","82.0.0","83.0.0","84.0.0","85.0.0","86.0.0","87.0.0","87.1.0","88.0.0","89.0.0","9.0.0","9.0.1","9.0.2","9.0.3","9.1.0","9.1.1","9.1.2","9.10.0","9.11.0","9.11.1","9.12.0","9.12.1","9.12.2","9.12.3","9.13.0","9.13.1","9.13.2","9.13.3","9.13.4","9.14.0","9.15.0","9.16.0","9.16.1","9.17.0","9.18.0","9.19.0","9.2.0","9.2.1","9.2.2","9.2.3","9.20.0","9.21.0","9.22.0","9.23.0","9.23.1","9.23.2","9.24.0","9.25.0","9.26.0","9.27.0","9.27.1","9.28.0","9.28.1","9.29.0","9.3.0","9.30.0","9.31.0","9.32.0","9.32.1","9.33.0","9.33.1","9.33.2","9.34.0","9.34.1","9.35.0","9.35.1","9.35.2","9.36.0","9.37.0","9.38.0","9.39.0","9.4.0","9.4.1","9.4.2","9.40.0","9.41.0","9.42.0","9.43.0","9.43.1","9.43.2","9.43.3","9.43.4","9.43.5","9.44.0","9.45.0","9.46.0","9.46.1","9.47.0","9.48.0","9.5.0","9.5.1","9.5.2","9.50.0","9.50.1","9.52.0","9.53.0","9.53.1","9.54.0","9.55.0","9.56.0","9.56.1","9.56.2","9.57.0","9.57.1","9.57.2","9.58.0","9.58.1","9.59.0","9.59.1","9.59.2","9.6.0","9.60.0","9.60.1","9.60.2","9.61.0","9.62.0","9.63.0","9.64.0","9.64.1","9.65.0","9.66.0","9.67.0","9.67.1","9.68.0","9.69.0","9.7.0","9.70.0","9.72.0","9.73.0","9.73.1","9.74.0","9.75.0","9.76.0","9.77.0","9.77.1","9.78.0","9.78.1","9.79.0","9.79.1","9.8.0","9.8.1","9.80.0","9.81.0","9.82.0","9.82.1","9.83.0","9.84.0","9.85.0","9.86.0","9.87.0","9.88.0","9.9.0","90.0.0","91.0.0","92.1.0","92.2.0","93.0.0","94.0.0","95.0.0","95.1.0","96.0.0","96.0.1","97.0.0","98.0.0","99.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-h4m4-xp33-37mj/GHSA-h4m4-xp33-37mj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}]}