CVE-2025-43782 json
Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name
published last yr. modified 22d ago also GHSA-wr8m-5h2p-4432 , EUVD-2025-28981
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API
Patch / fix
- maven com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl 5.0.48
- liferay digital_experience_platform 2024.Q1.13, 2024.Q2.8
- liferay liferay_portal 7.4.3.125
Is CVE-2025-43782 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl | >=5.0.1, <5.0.48 |
5.0.48 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/liferay/liferay-portal/commit/4e85bafae4c4e17d3f87054d1f1d49a908d79819
web
-
github.com
/liferay/liferay-portal/commit/720f2d3fde180e5c2971a5d01246dfec36f68131
web
-
github.com
/liferay/liferay-portal/commit/acf50c712f7f21c2f52db30883486cb885c8bdd0
web
-
github.com
/liferay/liferay-portal/commit/ad55ef75cb82c8b1ed01f311488475a646481731
web
-
github.com
/liferay/liferay-portal/commit/b61004c960e10d576634096fccc9f71677df0fbd
web
-
github.com
/liferay/liferay-portal/commit/c30a8b729e133f7f40277ce7dc350b87d13d49c7
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43782
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43782
advisory
-
github.com
/liferay/liferay-portal
web
Sources
- CVE List CVE-2025-43782
- GitHub Advisory GHSA-wr8m-5h2p-4432
- NVD CVE-2025-43782
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.