PT-2025-39912 · Liferay · Liferay Portal+1

Sébastien Sauty

·

Published

2025-09-29

·

Updated

2025-09-30

·

CVE-2025-43813

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.107 Liferay DXP versions 2023.Q3.1 through 2023.Q3.8 Liferay DXP versions 2023.Q4.0 through 2023.Q4.4 Liferay Portal 7.4 GA through update 92
Description The ComboServlet component may be susceptible to path traversal and denial-of-service conditions. This allows remote attackers to access arbitrary CSS and JSS files. Attackers can also load these files repeatedly by manipulating the query string within a URL.
Recommendations Update Liferay Portal to a version later than 7.4.3.107. Update Liferay Portal to a version later than 7.4 update 92. Update Liferay DXP to a version later than 2023.Q3.8. Update Liferay DXP to a version later than 2023.Q4.4. Update Liferay Portal to a version later than 7.3 update 35.

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-43813
GHSA-2HM7-R8F3-423H

Affected Products

Liferay Dxp
Liferay Portal