CVE-2025-43759
LOWLiferay Portal 7.4.0-7.4.3.132 and DXP 2024.Q1.1-2024.Q1.14 - Authenticated Tenant Enumeration via Page Addition
Title source: llmDescription
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.
References (1)
Core 1
Core References
Scores
CVSS v3
2.7
EPSS
0.0026
EPSS Percentile
17.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-732
Status
published
Products (5)
com.liferay/com.liferay.layout.impl
0 - 6.0.147Maven
liferay/digital_experience_platform
7.4
liferay/digital_experience_platform
2025.q1.0
liferay/digital_experience_platform
2024.Q1.1 - 2024.Q1.15
liferay/liferay_portal
7.4.0 - 7.4.3.132
Published
Aug 22, 2025
Tracked Since
Feb 18, 2026