CVE-2025-43805

MEDIUM

Liferay Portal 7.3.0-7.4.3.111 & DXP Unauthenticated Display Page Template Access

Title source: llm
STIX 2.1

Description

Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.

References (1)

Core 1

Scores

CVSS v3 5.3
EPSS 0.0006
EPSS Percentile 19.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
com.liferay/com.liferay.asset.display.page.service 0 - 4.0.55Maven
liferay/digital_experience_platform 7.3 (41 CPE variants)
liferay/digital_experience_platform 7.4 (8 CPE variants)
Published Sep 16, 2025
Tracked Since Feb 18, 2026