GitHub Advisoryadvisory · Maven

GHSA-43xf-59vr-g4f2 Liferay Portal Uses Default Password

MEDIUM Published 2025-09-15 Modified 2025-09-16 Official page ↗
Aliases
CVE-2025-43799
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1393
Reviewed
2025-09-16

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0, < 7.4.3.112 → fixed in 7.4.3.112

Description

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

Related

Alias · CVE (1)

  • CVE-2025-43799 Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA… vulnerability

Weakness · CWE (1)

  • CWE-1393 Use of Default Password weakness

References