CVE-2025-43759 json
Liferay Portal users are able to add system admin portlets to pages
published last yr. modified 4mo ago also GHSA-w3cr-3xw2-rp78 , EUVD-2025-28012
- cvss
- 2.7
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.
Patch / fix
- maven com.liferay:com.liferay.layout.impl 6.0.147
- liferay digital_experience_platform 2024.Q1.15
Is CVE-2025-43759 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.layout.impl | <6.0.147 |
6.0.147 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
-
github.com
/liferay/liferay-portal/commit/2e29e6733bc0e058bef89d16faac542bf2585346
web
-
github.com
/liferay/liferay-portal/commit/e8cbc7c27e5ed51c4079dd62738713f31afb46f7
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43759
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43759
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18185
web
Sources
- CVE List CVE-2025-43759
- GitHub Advisory GHSA-w3cr-3xw2-rp78
- NVD CVE-2025-43759
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.