CVE-2025-43782CWE-639

CVE-2025-43782

Medium · published September 11, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-09-11T22:15Z
Affected products (4)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2024.Q1.1, < 2024.Q1.132024.Q1.13
liferay/digital_experience_platform≥ 2024.Q2.0, < 2024.Q2.82024.Q2.8
liferay/digital_experience_platformall versions—
liferay/liferay_portal≥ 7.4.0, < 7.4.3.1257.4.3.125
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43782 · [email protected]
EPSS history
Timeline
  • 11 SEP 17:26Z
    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through…
    cvelistv5