CVE-2025-43789

MEDIUM

Liferay DXP 2024.Q1.1-2024.Q1.9 & 7.4.0-7.4.3.119 - Incorrect Authorization in JSON WS

Title source: llm
STIX 2.1

Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0004
EPSS Percentile 11.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (2)
com.liferay/com.liferay.comment.web 6.0.2 - 6.1.4Maven
liferay/digital_experience_platform 7.4 (49 CPE variants)
Published Sep 12, 2025
Tracked Since Feb 18, 2026