GitHub Advisoryadvisory · Maven

GHSA-fvp7-jj9m-3qpf Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

MEDIUM Published 2025-09-10 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43784
Ecosystem
Maven
Packages
com.liferay:com.liferay.headless.builder.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weaknesses
CWE-863
Reviewed
2025-09-12

Affected packages

• Maven com.liferay:com.liferay.headless.builder.impl: < 1.0.32 → fixed in 1.0.32

Description

An Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.

Related

Alias · CVE (1)

  • CVE-2025-43784 Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References