GitHub Advisoryadvisory · Maven

GHSA-95h4-8mqc-4mpf Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC

MEDIUM Published 2025-09-16 Modified 2025-09-16 Official page ↗
Aliases
CVE-2025-43801
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-606
Reviewed
2025-09-16

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 101.0.0 → fixed in 101.0.0

Description

Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to perform a denial-of-service (DoS) attacks via a crafted XML-RPC request.

Related

Alias · CVE (1)

  • CVE-2025-43801 Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and… vulnerability

Weakness · CWE (1)

  • CWE-606 Unchecked Input for Loop Condition weakness

References