PT-2025-37762 · Liferay · Liferay Dxp

Published 2025-09-15 · Updated 2025-09-16 · CVE-2025-43798

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay DXP versions 7.3 GA through update 35 Liferay DXP versions 7.4 GA through update 92

Description The software allows a time-based one-time password (TOTP) to be used multiple times during its validity period. This enables attackers who have access to a user’s TOTP to authenticate as that user.

Recommendations Update Liferay DXP to a version later than 7.3 update 35. Update Liferay DXP to a version later than 7.4 update 92. Update Liferay DXP to a version later than 2023.Q3.4. Update Liferay DXP to a version later than 2023.Q4.0.

Fix

Weakness Enumeration

CWE-304

Related Identifiers

CVE-2025-43798

GHSA-4P5R-3JMM-652Q

Affected Products

Liferay Dxp

References · 8

• https://osv.dev/vulnerability/CVE-2025-43798 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43798 · Security Note
• https://osv.dev/vulnerability/GHSA-4p5r-3jmm-652q · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/1df25e46675afe7c3a2754bf8968bcb9677db950 · Note
• https://twitter.com/CVEnew/status/1967819576084718060 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1967719959087218729 · Twitter Post