CVE-2025-43827: Medium severity Liferay portal vulnerability
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43827?
CVE-2025-43827 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive audit events.
How do I fix CVE-2025-43827?
To mitigate CVE-2025-43827, upgrade Liferay Portal to version 7.4.3.118 or later and Liferay DXP to version 2024.Q1.6 or later.
What versions of Liferay are affected by CVE-2025-43827?
CVE-2025-43827 affects Liferay Portal versions 7.4.0 through 7.4.3.117 and older unsupported versions, as well as multiple versions of Liferay DXP from 2023.Q3.1 to 2024.Q1.5.
What types of attacks can exploit CVE-2025-43827?
CVE-2025-43827 can be exploited through Insecure Direct Object Reference attacks that may lead to unauthorized data exposure.
Is CVE-2025-43827 remote or local in nature?
CVE-2025-43827 can be exploited remotely, allowing attackers to access vulnerable audit event data without local access.