GitHub Advisoryadvisory · Maven

GHSA-q86r-gwqc-jx85 Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

LOW Published 2025-09-12 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-43789
Ecosystem
Maven
Packages
com.liferay:com.liferay.comment.web
Severity
Low
CVSS vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2025-09-15

Affected packages

• Maven com.liferay:com.liferay.comment.web: >= 6.0.2, < 6.1.4 → fixed in 6.1.4

Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies to get executed.

Related

Alias · CVE (1)

  • CVE-2025-43789 JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References