PT-2025-35865 · Liferay · Kaleo Forms Admin+2

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-43772

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kaleo Forms Admin in Liferay Portal versions 7.0.0 through 7.4.3.4 Kaleo Forms Admin in Liferay DXP versions 7.3 GA through update 27 Kaleo Forms Admin in Liferay DXP version 7.4 GA Older unsupported versions

Description The application does not restrict the saving of request parameters in the portlet session. This allows remote attackers to consume system memory, potentially leading to denial-of-service (DoS) conditions via crafted HTTP requests.

Recommendations Versions prior to 7.4.3.4 are affected. Versions prior to Liferay DXP update 27 are affected. Versions prior to Liferay DXP 7.4 GA are affected. Versions prior to Liferay DXP 7.3 GA are affected.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-43772

GHSA-J4FW-4MHR-HC45

Affected Products

Kaleo Forms Admin

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-j4fw-4mhr-hc45 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43772 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/566ba7b48d6e8c62e5da71c34bb56b87183bf503 · Note
• https://github.com/liferay/liferay-portal/commit/5d62db9d01005fc148297dad37f84660cd8b4a2b · Note
• https://liferay.atlassian.net/browse/LPE-17456 · Note
• https://t.me/CVEtracker/31665 · Telegram Post
• https://twitter.com/CVEnew/status/1963439261589373092 · Twitter Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43772 · Note