Description

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.

Remediation

References

CVE-2025-43784

Related Vulnerabilities

OpenSSL Integer Overflow or Wraparound Vulnerability (CVE-2021-23840)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-9711)

WordPress Plugin Gallery-Flagallery Photo Portfolio Multiple Vulnerabilities (2.00)

WordPress Plugin Advanced Contact form 7 DB SQL Injection (1.6.0)

WordPress Plugin 3dady real-time web stats Cross-Site Request Forgery (1.0)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2025-43784