Description

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Remediation

References

CVE-2025-43788

Related Vulnerabilities

WordPress Plugin Ivory Search-WordPress Search Cross-Site Scripting (4.6.6)

WordPress Plugin RegistrationMagic-Custom Registration Forms, User Registration, Payment, and User Login Multiple Vulnerabilities (4.6.0.3)

IBMHttpServer Other Vulnerability (CVE-2004-0263)

Unfiltered header injection in Apache 1.3.34/2.0.57/2.2.1

Liferay DXP Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-4655)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-862 CVE-2025-43788