N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43760

CVE-2025-43760: Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43760

CVE-2025-43760:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.0-ga1, <= 7.4.3.132-ga132

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commits reveals a reflected cross-site scripting (XSS) vulnerability within the Liferay Portal. The root cause of this vulnerability lies in the escapeRedirect function located in com.liferay.portal.util.PortalImpl.

The vulnerability existed because the escapeRedirect function failed to properly sanitize and validate the scheme of the URL passed to it. This allowed for malicious javascript URIs (e.g., javascript:alert(1)) to be processed and reflected back to the user. When a user clicks on a crafted link containing such a URI, the javascript code executes in the user's browser session, leading to an XSS attack.

The patch, as seen in commit 7a1a7f0359e99be27ca04dab119e867c2263f040, addresses this issue by introducing a protocol validation mechanism. It adds a check to verify if the protocol of the given URL is present in a configurable list of allowed protocols. If the protocol is not in the allowed list, the function returns null, effectively blocking the malicious redirect. The addition of unit tests in commit 7c742f32f536dadfdbcad68acd20c63363728a25 further confirms this by explicitly testing for and nullifying redirects with javascript, file, and ftp protocols. The remaining commits are primarily for localization and configuration of this new security feature.

Therefore, the primary vulnerable function is com.liferay.portal.util.PortalImpl.escapeRedirect. During an exploit, this function would be present in the runtime profile as it processes the malicious URL.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.