CVE-2025-43801

HIGH

Liferay Digital Experience Platform < 7.3 and 7.4.0-7.4.3.111 - Denial of Service via XML-RPC

Title source: llm
STIX 2.1

Description

Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to perform a denial-of-service (DoS) attacks via a crafted XML-RPC request.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0018
EPSS Percentile 39.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-606
Status published
Products (3)
com.liferay.portal/com.liferay.portal.impl 0 - 101.0.0Maven
liferay/digital_experience_platform 7.3 (41 CPE variants)
liferay/digital_experience_platform 7.4 (8 CPE variants)
Published Sep 16, 2025
Tracked Since Feb 18, 2026