CVE-2025-43743

MEDIUM

Liferay Portal 7.4.0-7.4.3.132 & DXP Authenticated User Enumeration via Calendar Access

Title source: llm
STIX 2.1

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.

References (1)

Core 1

Scores

CVSS v3 4.3
EPSS 0.0026
EPSS Percentile 17.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-203
Status published
Products (2)
com.liferay.portal/release.portal.bom 7.4.0-ga1Maven
liferay/digital_experience_platform 7.4 update32 (49 CPE variants)
Published Aug 19, 2025
Tracked Since Feb 18, 2026