CVE-2025-43786

MEDIUM

Liferay Digital Experience Platform - Information Disclosure

Title source: rule

Description

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

References (1)

[Vendor Advisory] https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43786

Scores

CVSS v3 5.3

EPSS 0.0003

EPSS Percentile 9.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-79 CWE-203

Status published

Products (4)

com.liferay/com.liferay.headless.admin.workflow.impl 5.0.4 - 5.0.83Maven

com.liferay/com.liferay.portal.vulcan.impl 5.0.7 - 5.0.127Maven

com.liferay/com.liferay.portal.workflow.api 7.0.1 - 11.0.1Maven

liferay/digital_experience_platform 7.4 (47 CPE variants)

Published Sep 09, 2025

Tracked Since Feb 18, 2026