CVE-2025-43784
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An improper access control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP (2024.Q2.0-2024.Q2.8, 2024.Q1.1-2024.Q1.12, 7.4 GA through update 92) allows guest users to obtain object entries information via the API Builder.
Risk Assessment
Unauthenticated users can access information that should be protected. This may lead to leakage of internal data.
Recommendation
Update Liferay Portal/DXP to a version containing the fix. Until then, consider restricting guest access to the API Builder.
Other vulnerabilities in Liferay Portal, Liferay DXP
See all- CVE-2023-33946Low
The Object module in Liferay Portal versions 7.4.3.4 to 7.4.3.48 and Liferay DXP 7.4 before update 49 does not properly isolate objects in different virtual instances. This allows remote authenticated users in one virtual instance to view objects in a different virtual instance via the OAuth 2 scope administration page.
- CVE-2023-33939Medium
XSS vulnerability in the Modified Facet widget in Liferay Portal from versions 7.1.0 to 7.4.3.12 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a facet label.
Original NVD description (English source)
Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS