CVE-2025-43790

HIGH

Liferay Digital Experience Platform < 2024.Q1.13 - IDOR

Title source: rule

Description

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

References (1)

Core 1

Core References

Vendor Advisory

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43790

Scores

CVSS v3 8.1

EPSS 0.0006

EPSS Percentile 19.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-639

Status published

Products (4)

com.liferay/com.liferay.object.service 0 - 1.0.197Maven

liferay/digital_experience_platform 7.4

liferay/digital_experience_platform 2024.Q1.1 - 2024.Q1.13

liferay/liferay_portal 7.4.0 - 7.4.3.124

Published Sep 11, 2025

Tracked Since Feb 18, 2026