PT-2025-38612 · Liferay · Liferay Portal+1

Foobar7 · Published 2025-09-19 · Updated 2025-09-20 · CVE-2025-43803

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.119 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay DXP versions 2023.Q4.0 through 2023.Q4.6 Liferay Portal versions 7.4 GA through update 92

Description An insecure direct object reference (IDOR) issue exists in the Contacts Center widget. This allows remote attackers to view contact information, including the contact’s name and email address, via the entryId parameter.

Recommendations Liferay Portal versions 7.4.0 through 7.4.3.119: Update to a newer version. Liferay DXP versions 2023.Q3.1 through 2023.Q3.10: Update to a newer version. Liferay DXP versions 2023.Q4.0 through 2023.Q4.6: Update to a newer version. Liferay Portal versions 7.4 GA through update 92: Update to a newer version.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-43803

GHSA-8C8V-R5JJ-4425

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-43803 · Security Note
• https://osv.dev/vulnerability/GHSA-8c8v-r5jj-4425 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43803 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43803 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://twitter.com/CVEnew/status/1969291939548684507 · Twitter Post
• https://t.me/CVEtracker/32973 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1969209889726620092 · Twitter Post