The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
References
| Link | Resource |
|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43808 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2025-09-19 21:15
Updated : 2025-12-15 18:18
NVD link : CVE-2025-43808
Mitre link : CVE-2025-43808
CVE.ORG link : CVE-2025-43808
JSON object : View
Products Affected
liferay
- digital_experience_platform
- liferay_portal
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource
