GitHub Advisoryadvisory · Maven

GHSA-w3cr-3xw2-rp78 Liferay Portal users are able to add system admin portlets to pages

MEDIUM Published 2025-08-22 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43759
Ecosystem
Maven
Packages
com.liferay:com.liferay.layout.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-732
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.layout.impl: < 6.0.147 → fixed in 6.0.147

Description

Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.

Related

Alias · CVE (1)

  • CVE-2025-43759 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References