Description

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

Remediation

References

CVE-2025-43790

Related Vulnerabilities

WordPress Plugin Convert Plus Unspecified Vulnerability (3.5.6)

WordPress Plugin IgniteUp-Coming Soon and Maintenance Mode Multiple Vulnerabilities (3.4)

WordPress Plugin Question and Answer Forum 'title' Variable Cross-Site Scripting (1.2.4)

MySQL Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2005-0004)

Apache HTTP Server Other Vulnerability (CVE-2003-0189)

Severity

High

Classification

CVE-2025-43790 CWE-639 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities