CVE-2025-43797

Description

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is Open which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the site.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.058

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-43797 are fixed in Liferay - com.liferay.site.admin.web 5.0.111	Windows
Vulnerabilities CVE-2025-43797 are fixed in Liferay - com.liferay.site.admin.web for Linux 5.0.111	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234