CVE-2025-43759: Medium severity Liferay portal vulnerability
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43759?
CVE-2025-43759 has a high severity rating due to its potential to grant unauthorized access to pages on affected Liferay instances.
How do I fix CVE-2025-43759?
To fix CVE-2025-43759, upgrade Liferay Portal to version 7.4.4 or higher, and Liferay DXP to version 2025.Q1.1 or higher.
Who is affected by CVE-2025-43759?
CVE-2025-43759 affects admin users of Liferay Portal versions 7.4.0 through 7.4.3.132 and specific ranges of Liferay DXP versions.
What impact does CVE-2025-43759 have on my Liferay installation?
CVE-2025-43759 may allow unauthorized admin users to create and manage pages outside of the default instance, potentially exposing sensitive information.
Is CVE-2025-43759 being actively exploited?
As of now, there is no public information indicating that CVE-2025-43759 is being actively exploited, but it remains critical to apply the necessary updates.