CVE-2025-43810 — Authorization Bypass Through User-Controlled Key in Digital Experience Platform

CWE-639 — Authorization Bypass Through User-Controlled Key4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 84.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedSep 22
Latest updateSep 23

Description

Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶NVDliferay/liferay_portal7.2.0 — 7.4.3.113
▶CVEListV5liferay/portal7.4.0 — 7.4.3.112
▶NVDliferay/digital_experience_platform2023.Q4.0 — 2023.Q4.9+2
▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+2

🔴Vulnerability Details

3
OSV
Liferay Portal and DXP allows users to add a note to a different virtual instance↗2025-09-23
▶
GHSA
Liferay Portal and DXP allows users to add a note to a different virtual instance↗2025-09-23
▶
CVEList
CVE-2025-43810: Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7↗2025-09-22
▶
CVE-2025-43810 — MEDIUM severity | cvebase