VULNERABILITY INTELLIGENCE

CVE-2025-43786

CVSS score5.3 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2025-09-09
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

Weakness classification

  • security@liferay.com: CWE-79
  • nvd@nist.gov: CWE-203

Primary references