GitHub Advisoryadvisory · Maven

GHSA-xvgg-9h29-4g34 Liferay Portal has Improper Validation of Specified Quantity in Input

MEDIUM Published 2025-09-15 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-43793
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:com.liferay.portal.kernel
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-1284
Reviewed
2025-09-15

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 96.0.0 → fixed in 96.0.0 • Maven com.liferay.portal:com.liferay.portal.kernel: < 130.0.1 → fixed in 130.0.1

Description

Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the application.

Related

Alias · CVE (1)

  • CVE-2025-43793 Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA… vulnerability

Weakness · CWE (1)

  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References