CVE-2025-43790: High severity Liferay portal vulnerability
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43790?
CVE-2025-43790 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2025-43790?
To fix CVE-2025-43790, update your Liferay Portal or Liferay DXP to the latest patched version.
What versions of Liferay are affected by CVE-2025-43790?
CVE-2025-43790 affects Liferay Portal versions 7.4.0 to 7.4.3.124 and Liferay DXP versions from 2024.Q1.1 to 2024.Q2.6.
Can remote authenticated users exploit CVE-2025-43790?
Yes, remote authenticated users can exploit CVE-2025-43790 to access, create, or edit data across different virtual instances.
Is there a specific path for vulnerability remediation in CVE-2025-43790?
The specific path for remediation includes applying the latest software updates provided by Liferay to address the vulnerability.