PT-2025-39087 · Liferay · Liferay Portal+1

Foobar7 · Published 2025-09-22 · Updated 2025-09-23 · CVE-2025-43810

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.5 through 7.4.3.112 Liferay DXP versions 2023.Q4.0 through 2023.Q4.8 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay versions 7.4 GA through update 92

Description An Insecure Direct Object Reference (IDOR) issue exists in commerce order notes. Remote authenticated users can add a note to an order in a different virtual instance. This is possible through manipulation of the com liferay commerce order web internal portlet CommerceOrderPortlet commerceOrderId parameter.

Recommendations Liferay Portal versions 7.3.5 through 7.4.3.112 should be updated. Liferay DXP versions 2023.Q4.0 through 2023.Q4.8 should be updated. Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 should be updated. Liferay versions 7.4 GA through update 92 should be updated.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-43810

GHSA-F372-9RCJ-8W2C

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43810 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-43810 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f372-9rcj-8w2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43810 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/72259fbf5a81596e99b615df480dee0b0fa3aa09 · Note
• https://github.com/liferay/liferay-portal/commit/9fad6a23b3c04146ef80a59b056f24b17cc2e721 · Note
• https://t.me/CVEtracker/33102 · Telegram Post
• https://twitter.com/CVEnew/status/1970393479051112569 · Twitter Post
• https://t.me/cveNotify/136077 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17935 · Note