Description

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

Remediation

References

CVE-2025-43790

Related Vulnerabilities

WordPress Plugin Multisite Plugin Manager Multiple Cross-Site Scripting Vulnerabilities (3.1.1)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-5324)

Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-34265)

Ruby on Rails CVE-2006-4112 Vulnerability (CVE-2006-4112)

WordPress Plugin Login with phone number Security Bypass (1.7.26)

Severity

High

Classification

CVE-2025-43790 CWE-639 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities