Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-43797: Liferay Portal and DXP allow unauthorized site access

CVE-2025-43797 · published 1 year ago

Summary

Liferay Portal and DXP versions 7.1 to 7.4 and Liferay DXP 2023 Q3 and Q4 allow any registered user to join a new site and access its content. This means an attacker could potentially view, add, or edit content on a site without permission. To mitigate this risk, update to a fixed version or restrict site membership settings.

What to do

Update liferay com.liferay:com.liferay.site.admin.web to version 5.0.111.
Update liferay liferay_portal to version 7.4.3.112 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	liferay	com.liferay:com.liferay.site.admin.web	< 5.0.111 Fix: upgrade to 5.0.111
–	liferay	digital_experience_platform	< 7.3 >= 2023.q3.1, < 2023.q3.5 7.3 7.4 2023.q4.0 `cpe:2.3:a:liferay:digital_experience_platform::::::::`
–	liferay	liferay_portal	< 7.4.3.112 `cpe:2.3:a:liferay:liferay_portal::::::::`

Original advisory text

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the site.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-1188Initialization of a Resource with an Insecure Default

Timeline

Published15 Sep 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-25m3-w28p-v3v3 · GHSA

CVE-2025-43797 · NVD

Track software like this

Free during beta