Description

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

Remediation

References

CVE-2025-43808

Related Vulnerabilities

WordPress Plugin WC Duplicate Order Unspecified Vulnerability (1.3)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-15809)

WordPress Plugin Local Market Explorer 'api-key' Parameter Cross-Site Scripting (3.1.1)

WordPress Plugin GdeSlon Affiliate Shop Open Redirect (2.0)

Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-5539)

Severity

Medium

Classification

CVE-2025-43808 CWE-732 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities