CVE-2025-43808

published 2025-09-19

CVE-2025-43808: The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through…

medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	—	—
liferay	digital_experience_platform	2023.Q3.1 – 2023.Q3.10	—
liferay	digital_experience_platform	>= 2023.Q4.0 < 2023.Q4.9	2023.Q4.9
liferay	dxp	2023.Q3.1 – 2023.Q3.10	—
liferay	dxp	2023.Q4.0 – 2023.Q4.8	—
liferay	dxp	7.3.10 – 7.3.10-u36	—
liferay	dxp	7.4.13 – 7.4.13-u92	—
liferay	liferay_portal	>= 7.4.0 < 7.4.3.113	7.4.3.113
liferay	portal	7.3.0 – 7.4.3.112	—

CWE-732