CVE-2025-43799 — Use of Default Password in Digital Experience Platform

CWE-1393 — Use of Default PasswordCWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.9MEDIUMNVD
EPSS
0.1%
top 83.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedSep 15

Description

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDliferay/liferay_portal< 7.4.3.112
▶CVEListV5liferay/portal7.4.0 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.5+4
▶CVEListV5liferay/dxp7.3.10 — 7.3.10-u35+3

🔴Vulnerability Details

3
GHSA
Liferay Portal Uses Default Password↗2025-09-15
▶
CVEList
CVE-2025-43799: Liferay Portal 7↗2025-09-15
▶
OSV
Liferay Portal Uses Default Password↗2025-09-15
▶

📋Vendor Advisories

1
Microsoft
send vulnerable to template injection that can lead to XSS↗2024-09-10
▶
CVE-2025-43799 — Use of Default Password | cvebase