CVE-2025-43739 json
Liferay Portal Email Modification Vulnerability via Calendar Portlet
published last yr. modified 4mo ago also GHSA-7mxq-h2r7-h449 , EUVD-2025-25166
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.
Patch / fix
- maven com.liferay:com.liferay.calendar.service 6.0.83
- liferay digital_experience_platform 2025.Q1.7
- github.com/liferay/liferay-portal@0a9f5df commit
- github.com/liferay/liferay-portal@5dc74a9 commit
- github.com/liferay/liferay-portal@75be892 commit
- github.com/liferay/liferay-portal@7d70fab commit
- github.com/liferay/liferay-portal@7eb5516 commit
- github.com/liferay/liferay-portal@a01a99c commit
- github.com/liferay/liferay-portal@b396c00 commit
- github.com/liferay/liferay-portal@c1660f1 commit
- github.com/liferay/liferay-portal@e50c1a0 commit
- github.com/liferay/liferay-portal@f238677 commit
Is CVE-2025-43739 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.calendar.service | <6.0.83 |
6.0.83 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/liferay/liferay-portal/commit/0a9f5df16ae0afa8216ca568b89b2cdf00054bde
web
-
github.com
/liferay/liferay-portal/commit/5dc74a9f53f0aaa6cc1b6e0f503842832324239a
web
-
github.com
/liferay/liferay-portal/commit/75be892f7cf31e1a38555d45627b0c2a06490d3d
web
-
github.com
/liferay/liferay-portal/commit/7d70fab2259ff8b4a775021eb95bfc183823f8fc
web
-
github.com
/liferay/liferay-portal/commit/7eb551616c6b8beeaf660ff7f29b09794cb80d91
web
-
github.com
/liferay/liferay-portal/commit/a01a99cc4a5c7436f49790a1bfb386299172149c
web
-
github.com
/liferay/liferay-portal/commit/b396c00338e754976a9f63ea1d5393f29babdabb
web
-
github.com
/liferay/liferay-portal/commit/c1660f1a906c5ee3adca51e68f0abd6f9c1d253f
web
-
github.com
/liferay/liferay-portal/commit/e50c1a0a53d30b4e55f47495e265c5b7ea3459e1
web
-
github.com
/liferay/liferay-portal/commit/f238677d9afb46cfe4e23f05ce11bd5197a70388
web
-
github.com
/liferay/liferay-portal/commit/ff18e7d363f2a3bc83e9d3446f1bc49bee821883
web
-
github.com
/liferay/liferay-portal/commit/ff927f3f6784b396d3a611ac2e5e99b69ff0fd05
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43739
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43739
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18210
web
Sources
- CVE List CVE-2025-43739
- GitHub Advisory GHSA-7mxq-h2r7-h449
- NVD CVE-2025-43739
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.