PT-2025-37752 · Liferay · Liferay Portal+1

4Rth4S · Published 2025-09-15 · Updated 2025-09-20 · CVE-2025-43799

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal 7.4 GA through update 92

Description The software does not restrict access to APIs before a user has changed their initial password, potentially allowing remote users to access and edit content via the API.

Recommendations Update Liferay Portal versions prior to 7.4.3.111. Update Liferay DXP versions prior to 2023.Q4.0. Update Liferay Portal versions prior to 7.4 GA update 92. Update Liferay Portal versions prior to 7.3 GA update 35.

Fix

Weakness Enumeration

CWE-1393

Related Identifiers

CVE-2025-43799

GHSA-43XF-59VR-G4F2

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-43xf-59vr-g4f2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43799 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43799 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://twitter.com/VulmonFeeds/status/1967717399060267489 · Twitter Post
• https://twitter.com/CVEnew/status/1969291999980278109 · Twitter Post
• https://t.me/CVEtracker/32558 · Telegram Post