CVE-2025-43739 — Observable Discrepancy in Digital Experience Platform

CWE-203 — Observable Discrepancy4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 85.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay DXPLiferay Portal+1 more
Timeline
PublishedAug 19

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.0 — 7.4.3.132
▶NVDliferay/liferay_portal7.4.3.94 — 7.4.3.132
▶NVDliferay/digital_experience_platform2025.Q1.0 — 2025.Q1.7+5
▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+5

🔴Vulnerability Details

3
CVEList
CVE-2025-43739: Liferay Portal 7↗2025-08-19
▶
GHSA
Liferay Portal Email Modification Vulnerability via Calendar Portlet↗2025-08-19
▶
OSV
Liferay Portal Email Modification Vulnerability via Calendar Portlet↗2025-08-19
▶
CVE-2025-43739 — Observable Discrepancy | cvebase