Vulnerability in Liferay Portal Commerce Component Exposes Virtual Products
CVE-2025-43808

6.9MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
19 September 2025

What is CVE-2025-43808?

A vulnerability in the Commerce component of Liferay Portal allows for unauthorized access to virtual products uploaded to Documents and Media. Versions 7.3.0 through 7.4.3.112 and specific versions of Liferay DXP are affected. This issue can be exploited by remote attackers who can craft specific URLs to gain free access and download virtual products. Mitigating this risk requires updates to the affected Liferay releases to ensure proper access controls.

Affected Version(s)

DXP 7.3.10 <= 7.3.10-u36

DXP 7.4.13 <= 7.4.13-u92

DXP 2023.Q3.1 <= 2023.Q3.10

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

foobar7
.
CVE-2025-43808 : Vulnerability in Liferay Portal Commerce Component Exposes Virtual Products