Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

Remediation

References

CVE-2025-43789

Related Vulnerabilities

phpMyFAQ Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-4825)

WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-5270)

MySQL CVE-2018-2777 Vulnerability (CVE-2018-2777)

Bootstrap Table Access of Resource Using Incompatible Type ('Type Confusion') Vulnerability (CVE-2021-23472)

WordPress Plugin WP Custom Fields Search Cross-Site Scripting (1.2.34)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2025-43789