icon

We found results for “

CVE-2025-43797

Good to know:

icon
icon

Date: September 15, 2025

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the site.

Severity Score

Severity Score

Weakness Type (CWE)

Initialization of a Resource with an Insecure Default

CWE-1188

Top Fix

icon

Upgrade Version

Upgrade to version com.liferay:com.liferay.site.admin.web:5.0.111

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us