CVE-2025-43788

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-43788
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43788.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-43788
Aliases
Published
2025-09-12T03:15:41.480Z
Modified
2026-07-08T07:43:35.213816404Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "liferay:digital_experience_platform",
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "introduced": "2024.Q1.1"
                },
                {
                    "fixed": "2024.Q1.13"
                }
            ]
        },
        {
            "vendor_product": "liferay:digital_experience_platform",
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.4-update81"
                },
                {
                    "last_affected": "7.4-update81"
                },
                {
                    "introduced": "7.4-update82"
                },
                {
                    "last_affected": "7.4-update82"
                },
                {
                    "introduced": "7.4-update83"
                },
                {
                    "last_affected": "7.4-update83"
                },
                {
                    "introduced": "7.4-update84"
                },
                {
                    "last_affected": "7.4-update84"
                },
                {
                    "introduced": "7.4-update85"
                },
                {
                    "last_affected": "7.4-update85"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
386e7152d5ca43b9673b581617a8f5afc02a3673
Last affected
607e862df7671e241e3e8cc7bd35bccbb89156cf
Introduced
b77647a3103c2ab46593d454768502a6b7715e20
Fixed
83a76c250ad0b00a6d961e7b37fe0959b32b03de
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.4.3.81"
        },
        {
            "last_affected": "7.4.3.85"
        },
        {
            "introduced": "7.4.3.94"
        },
        {
            "fixed": "7.4.3.125"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43788.json"