N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43817

CVE-2025-43817: Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the redirect parameter to (1) Announcements, or (2) Alerts.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43817

CVE-2025-43817:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.4.3.74-ga74, <= 7.4.3.111-ga111	7.4.3.112-ga112

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected cross-site scripting (XSS) issue in Liferay Portal, identified as CVE-2025-43817. The vulnerability is triggered when a user is directed to the 'Announcements' or 'Alerts' pages with a malicious redirect parameter in the URL. The value of this parameter is used to construct a navigation link, but it is not properly sanitized, leading to the execution of injected scripts.

The analysis of the provided patch commit 40b9dcafccff4b0ba2a20ef4c9723bea820f814b reveals the root cause of the vulnerability. The commit modifies the portal-web/docroot/html/taglib/aui/button/end.jsp file, which is a JSP tag file responsible for rendering buttons in the Liferay UI.

The vulnerable code snippet is:

<c:when test="<%= Validator.isNotNull(escapedHREF) %>">
    <button ... onClick="Liferay.Util.navigate('<%= escapedHREF %>')" ...>
</c:when>

Here, escapedHREF is populated with the value from the redirect parameter. By crafting a malicious redirect parameter, an attacker can break out of the string literal in the Liferay.Util.navigate function and inject arbitrary JavaScript. For example, a redirect value of x' onload='alert(1) would result in executable JavaScript.

The patch fixes this by separating the data from the code. The escapedHREF is now stored in a data-href attribute, and the onClick handler safely retrieves this value using this.dataset.href. This ensures that the redirect parameter is treated as data and not as executable code.

Since this is a JSP file, it gets compiled into a Java Servlet at runtime. The vulnerable code is executed within the _jspService method of the compiled servlet. Therefore, the function org.apache.jsp.html.taglib.aui.button.end_jsp._jspService is the precise function that would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.