PT-2025-37766 · Liferay · Liferay Portal+1

Published 2025-09-15 · Updated 2025-12-16 · CVE-2025-43797

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal 7.3 GA through update 35 Liferay Portal 7.4 GA through update 92

Description The default membership type of a newly created site is “Open,” allowing any registered users to become a member. A remote attacker with site membership can potentially view, add, or edit content on the site.

Recommendations For Liferay Portal versions 7.1.0 through 7.4.3.111, ensure the default membership type for new sites is not set to “Open.” For Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, ensure the default membership type for new sites is not set to “Open.” For Liferay DXP version 2023.Q4.0, ensure the default membership type for new sites is not set to “Open.” For Liferay Portal 7.3 GA through update 35, ensure the default membership type for new sites is not set to “Open.” For Liferay Portal 7.4 GA through update 92, ensure the default membership type for new sites is not set to “Open.”

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-43797

GHSA-25M3-W28P-V3V3

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-43797 · Security Note
• https://osv.dev/vulnerability/GHSA-25m3-w28p-v3v3 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43797 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43797 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://twitter.com/CVEnew/status/1967819569742889367 · Twitter Post
• https://t.me/cveNotify/145958 · Telegram Post
• https://t.me/cveNotify/135552 · Telegram Post