CVE-2025-43772

published 2025-09-04

CVE-2025-43772: Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict…

Priority P3 37 high 7.1 CVSS 4.0

AV N AC L AT N PR L UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
liferay	dxp	6.2.0 – portal-173	—
liferay	dxp	7.0.10 – de-102	—
liferay	dxp	7.1.10 – dxp-28	—
liferay	dxp	7.2.10 – dxp-20	—
liferay	dxp	7.3.10 – 7.3.10-u27	—
liferay	dxp	7.4.13 – 7.4.13-u1	—
liferay	portal	7.0.0 – 7.4.3.5	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400