Description

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

Remediation

References

CVE-2025-43799

Related Vulnerabilities

WordPress Plugin Zita Elementor Site Library Arbitrary File Upload (1.6.1)

MyBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-29457)

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0791)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59540)

WordPress Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-4029)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CVE-2025-43799