CVE-2025-43815: 
Java vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability was discovered in Liferay Portal and DXP systems, identified as CVE-2025-43815. The vulnerability affects Liferay Portal versions 7.4.3.102 through 7.4.3.110, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.2, and 2023.Q3.5. The issue was reported by security researcher argon21 and was publicly disclosed on September 12, 2024 (Liferay Security).

The vulnerability exists on the page configuration page where remote attackers can inject arbitrary web script or HTML through the comliferaylayoutadminwebportletGroupPagesPortlet_backURLTitle parameter. The severity of this vulnerability has been assessed with a CVSS 4.0 score of 5.1, indicating a medium severity level. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD Database).

The vulnerability allows attackers to execute arbitrary web scripts or inject HTML content through the affected parameter, potentially leading to unauthorized access to user data, session hijacking, or other malicious activities typically associated with XSS attacks (Liferay Security).

The vulnerability has been patched in Liferay Portal version 7.4.3.111 and Liferay DXP versions 2024.Q1.1, 2023.Q4.3, and 2023.Q3.6. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).