CVE-2025-43770: 
Java vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability (CVE-2025-43770) affects Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP versions spanning from 2024.Q1.1 through 2024.Q4.3, as well as DXP 7.4 GA through update 92. The vulnerability allows remote unauthenticated attackers to inject JavaScript into the referer or FORWARD_URL parameters using %00 (Liferay Advisory).

The vulnerability has been assigned a CVSS v4.0 Base Score of 6.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The technical assessment indicates that the vulnerability requires low attack complexity, no authentication, and can be exploited remotely without user interaction. The impact affects both confidentiality and integrity at a low level, with no impact on availability (Liferay Advisory).

The vulnerability allows attackers to perform cross-site scripting attacks by injecting malicious JavaScript code through the referer or FORWARD_URL parameters. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (Liferay Advisory).

Organizations should upgrade to the fixed versions: Liferay Portal 7.4.3.132, Liferay DXP 2024.Q1.13, Liferay DXP 2024.Q4.4, or Liferay DXP 2025.Q1.0 (Liferay Advisory).