Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Liferay | Portal | 7.4.3.132 | — |
| Liferay | DXP | 2025.Q1.0 – ≤ 2025.Q1.15, 2025.Q2.0 – ≤ 2025.Q2.8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay:com.liferay.journal.web | < 5.0.196 | 5.0.196 | GHSA-vjwr-cqwf-6q96 |
Advisories 1
- WID-SEC-2025-1865 Liferay Portal und DXP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 19, 2025