Liferay Portal and DXP Vulnerability Exposes ERC Enumeration Risk

CVE-2025-43786

What is CVE-2025-43786?

The vulnerability allows attackers to exploit response time variations in Liferay Portal and DXP, enabling them to enumerate existing ERC entries within the application. This occurs in specific versions of Liferay Portal and DXP, where improper handling of object entries can lead to disclosure of sensitive information, thus raising concerns about potential abuse in security contexts.

References