GitHub Advisoryadvisory · Maven

GHSA-chr3-w547-85hw Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource

MEDIUM Published 2025-09-19 Modified 2025-12-16 Official page ↗
Aliases
CVE-2025-43808
Ecosystem
Maven
Packages
com.liferay.commerce:com.liferay.commerce.product.type.virtual.service
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-732
Reviewed
2025-09-19

Affected packages

• Maven com.liferay.commerce:com.liferay.commerce.product.type.virtual.service: < 4.0.47 → fixed in 4.0.47

Description

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 Service Pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2025-43808 The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References