CVE-2025-43789

Liferay / Portal PUBLISHED

Description (CNA)

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

Affected (CNA)

Vendor / product	Versions
Liferay / Portal	affected 7.4.0 through 7.4.3.119
Liferay / DXP	affected 7.4.13 through 7.4.13-u92; affected 2024.Q1.1 through 2024.Q1.9

CWE

CWE-863

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43789

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.