GitHub Advisoryadvisory · Maven

GHSA-9p7x-8c57-4pqv Liferay Portal exposes ERC which can lead to exploit the time response attack

MEDIUM Published 2025-09-09 Modified 2025-09-11 Official page ↗
Aliases
CVE-2025-43786
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.vulcan.impl, com.liferay:com.liferay.headless.admin.workflow.impl, com.liferay:com.liferay.portal.workflow.api
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-203, CWE-208
Reviewed
2025-09-11

Affected packages

• Maven com.liferay:com.liferay.portal.vulcan.impl: >= 5.0.7, < 5.0.127 → fixed in 5.0.127 • Maven com.liferay:com.liferay.headless.admin.workflow.impl: >= 5.0.4, < 5.0.83 → fixed in 5.0.83 • Maven com.liferay:com.liferay.portal.workflow.api: >= 7.0.1, < 11.0.1 → fixed in 11.0.1

Description

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

Related

Alias · CVE (1)

  • CVE-2025-43786 Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0… vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-208 Observable Timing Discrepancy weakness

References