CVE-2025-43795: Liferay Digital Experience Platform

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_SystemSettingsPortlet_redirect parameter. Open redirect vulnerability in the Instance Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_configuration_admin_web_portlet_InstanceSettingsPortlet_redirect parameter. Open redirect vulnerability in the Site Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_site_admin_web_portlet_SiteSettingsPortlet_redirect parameter.

Affected products

• Liferay Digital Experience Platform: before 7.3 (fixed in 7.3); from 2023.Q3.0, before 2023.Q3.5 (fixed in 2023.Q3.5); version 7.3 only; version 7.4 only
• Liferay Liferay Portal: from 7.1.0, before 7.4.3.102 (fixed in 7.4.3.102)

Published 2025-09-12. Last modified 2026-06-17.