CVE-2025-43789CWE-863broken-access-control

CVE-2025-43789

Medium · published September 12, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-09-12T07:15Z
Affected products (95)
ProductVersionsFixed in
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/liferay_portal≥ 7.4.0, < 7.4.3.1207.4.3.120
liferay/digital_experience_platform≥ 2024.Q1.1, < 2024.Q1.102024.Q1.10
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
liferay/digital_experience_platformall versions—
References (1)
EPSS history
Timeline
  • 12 SEP 02:00Z
    JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are…
    cvelistv5