Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

Remediation

References

CVE-2025-43789

Related Vulnerabilities

WordPress Plugin Link Library 'id' Parameter Cross-Site Scripting and SQL Injection Vulnerabilities (5.0.8)

WordPress Plugin Qtranslate Slug Cross-Site Request Forgery (1.1.18)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2009-1149)

WordPress Plugin Titan Framework Cross-Site Scripting (1.7.5)

WordPress Plugin Easy Custom Auto Excerpt Cross-Site Scripting (2.4.6)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2025-43789