CVE-2025-43784 MEDIUM

CVE-2025-43784

Vendor Liferay
Product Portal
Weakness CWE-863 · Incorrect authorization
Published September 10, 2025
Last update September 10, 2025
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

What the vulnerability does

01Description

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.

Key dates

02Disclosure timeline

September 10, 2025 CVE published
September 10, 2025 Record updated