GitHub Advisoryadvisory · Maven

GHSA-25m3-w28p-v3v3 Liferay has Insecure Default Initialization of Resource issue

MEDIUM Published 2025-09-16 Modified 2025-09-16 Official page ↗
Aliases
CVE-2025-43797
Ecosystem
Maven
Packages
com.liferay:com.liferay.site.admin.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1188
Reviewed
2025-09-16

Affected packages

• Maven com.liferay:com.liferay.site.admin.web: < 5.0.111 → fixed in 5.0.111

Description

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the site.

Related

Alias · CVE (1)

  • CVE-2025-43797 In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References