CVE-2025-43824

MEDIUM

Liferay Portal 7.4.0-7.4.3.111 & DXP 2023.Q4.0-2023.Q4.5 - Authenticated File Extension Manipulation

Title source: llm
STIX 2.1

Description

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.

References (1)

Core 1

Scores

CVSS v3 5.4
EPSS 0.0003
EPSS Percentile 10.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
com.liferay.portal/release.portal.bom 7.4.0-ga1 - 7.4.3.112-ga112Maven
liferay/digital_experience_platform < 7.4
liferay/liferay_portal < 7.4.3.112
Published Oct 06, 2025
Tracked Since Feb 18, 2026