IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-19 19:15

MODIFIED

2025-08-20 14:40

EPSS (Prob. Exploit)

0.29%

Top 78.8%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-10-11

> DESCRIPTION

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via _com_liferay_journal_web_portlet_JournalPortlet_backURL parameter.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-vjwr-cqwf-6q96 MODERATE

Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.journal.web

< 5.0.196

Fixed in: 5.0.196

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

10 versions affected

ALIASES:

GHSA-vjwr-cqwf-6q96

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/08/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui