← CVE Intelligence

CVE-2025-43827

Liferay / Portal PUBLISHED

Description (CNA)

Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter.

Affected (CNA)

Vendor / productVersions
Liferay / Portalaffected 7.4.0 through 7.4.3.117
Liferay / DXPaffected 7.4.13 through 7.4.13-u92; affected 2023.Q3.1 through 2023.Q3.10; affected 2023.Q4.0 through 2023.Q4.10; affected 2024.Q1.1 through 2024.Q1.5

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.