CVE-2025-43799

MEDIUM

Liferay Portal <7.4.3.111 & DXP - Info Disclosure

Title source: llm
STIX 2.1

Description

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0006
EPSS Percentile 17.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1393
Status published
Products (3)
com.liferay.portal/release.portal.bom 7.4.0 - 7.4.3.112Maven
liferay/digital_experience_platform 7.3 (41 CPE variants)
liferay/digital_experience_platform 7.4 update20 (8 CPE variants)
Published Sep 15, 2025
Tracked Since Feb 18, 2026