Paper/Archive/CVE-2025-43773

CVE-2025-43773

Liferay Portal — Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0…

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 21.4.214 × 204.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.

Affected

ProductAffectedFixed inSource

Portal7.4.0 – 7.4.3.132–CNA

DXP7.4.13 – 7.4.13-u92–CNA

DXP2024.Q1.1 – 2024.Q1.18–CNA

DXP2024.Q2.0 – 2024.Q2.13–CNA

DXP2024.Q3.0 – 2024.Q3.13–CNA

DXP2024.Q4.0 – 2024.Q4.7–CNA

DXP2025.Q1.0 – 2025.Q1.14–CNA

DXP2025.Q2.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Liferay (CNA)4.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43773