com.liferay:com.liferay.journal.content.web (>=1.1.7, <=2.0.8) potentially affected by CVE-2025-43737 via com.liferay:com.liferay.journal.web (1.5.0)

com.liferay:com.liferay.journal.web MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay:com.liferay.journal.web and may be impacted: - com.liferay:com.liferay.journal.content.web =1.1.7, =2.0.8 Source cves: CVE-2025-43737...

CVE-2025-43737

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via comliferayjournalwebportletJournalPortletbackURL parameter...