Improper Access Control in Liferay Portal and DXP Vulnerability
CVE-2025-43784

6.2MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
10 September 2025

What is CVE-2025-43784?

An improper access control vulnerability has been identified in Liferay Portal versions between 7.4.0 and 7.4.3.124, as well as in various versions of Liferay DXP including 2024.Q2.0 to 2024.Q2.8 and 2024.Q1.1 to 2024.Q1.12. This vulnerability allows guest users to gain unauthorized access to object entries information via the API Builder, potentially leading to sensitive information exposure. It is essential for users running these versions to take immediate action to mitigate this risk.

Affected Version(s)

DXP 7.4.13 <= 7.4.13-u92

DXP 2024.Q1.1 <= 2024.Q1.12

DXP 2024.Q2.0 <= 2024.Q2.8

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-43784 : Improper Access Control in Liferay Portal and DXP Vulnerability