CVE-2025-43790CWE-639

CVE-2025-43790

High · published September 11, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-09-11T22:15Z
Affected products (4)
ProductVersionsFixed in
liferay/digital_experience_platform≥ 2024.Q1.1, < 2024.Q1.132024.Q1.13
liferay/digital_experience_platform≥ 2024.Q2.0, < 2024.Q2.72024.Q2.7
liferay/digital_experience_platformall versions—
liferay/liferay_portal≥ 7.4.0, < 7.4.3.1247.4.3.124
References (1)
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43790 · [email protected]
EPSS history
Timeline
  • 11 SEP 17:54Z
    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through…
    cvelistv5