PT-2025-37278 · Liferay · Liferay Portal+2

Published 2025-09-12 · Updated 2025-09-12 · CVE-2025-43789

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.119 Liferay DXP versions 2024.Q1.1 through 2024.Q1.9 Liferay DXP 7.4 GA through update 92

Description: JSON Web Services in Liferay Portal and DXP are registered and invoked directly as classes, allowing Service Access Policies to be executed. This allows for a bypass of intended security mechanisms.

Recommendations: Update Liferay Portal to a version later than 7.4.3.119. Update Liferay DXP to a version later than 2024.Q1.9. Update Liferay DXP 7.4 to a version later than update 92.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-43789

GHSA-Q86R-GWQC-JX85

Affected Products

Liferay Dxp

Liferay Dxp 7.4

Liferay Portal

References · 10

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43789 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43789 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q86r-gwqc-jx85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43789 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/576039619a12f28304c5153ad3fa5e39f00548b3 · Note
• https://github.com/liferay/liferay-portal/commit/e91daba3736ea30674f0beb5f6622c6df057d18b · Note
• https://github.com/liferay/liferay-portal/commit/dfdd81d51808e38098e9a3250f3c8819e0761377 · Note
• https://github.com/liferay/liferay-portal/commit/cb349be999396e97883e5fa7ccf2d226737779ac · Note
• https://twitter.com/VulmonFeeds/status/1966408666745041173 · Twitter Post