CVE-2025-43790
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
Risk Assessment
An authenticated user could breach virtual instance isolation by modifying data in instances they should not access.
Recommendation
Install the Liferay vendor patch and review user permissions across virtual instances.
Other vulnerabilities in Liferay Portal and Liferay DXP
See all- CVE-2025-62259Medium
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP in specified versions do not limit API access before a user has verified their email address. Remote users can access and edit content via the API without email verification.
- CVE-2025-43816High
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119 and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
Original NVD description (English source)
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS