Description

Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.

Remediation

References

CVE-2025-43805

Related Vulnerabilities

Oracle HTTP Server Improper Encoding or Escaping of Output Vulnerability (CVE-2022-25235)

WordPress Plugin WP Business Intelligence Lite Arbitrary File Upload (1.0.6)

Coppermine Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3481)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-4698)

Perl Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-1238)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-862 CVE-2025-43805