Home > Vulnerability Database > CVE-2025-43784

Mend.io Vulnerability Database

CVE-2025-43784

Good to know:

Date: September 10, 2025

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.

Severity Score

0.0

Related Resources (6)

Url: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43784

Url: https://github.com/liferay/liferay-portal/commit/ccbae813d4a9ec66597191f58d1cb4137f264c99

Url: https://github.com/liferay/liferay-portal

Url: https://liferay.atlassian.net/browse/LPE-18066

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-43784

Url: https://www.mend.io/vulnerability-database/CVE-2025-43784

Weakness Type (CWE)

Incorrect Authorization

CWE-863

Top Fix

Upgrade Version

Upgrade to version com.liferay:com.liferay.headless.builder.impl:1.0.32

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE