Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

MEDIO 5.3CVE-2025-43758 · GHSA-mm62-gwj5-j285 · Published 22/08/2025 · updated 17/06/2026

In breve

CVE-2025-43758 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda com.liferay:com.liferay.frontend.js.web, com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type, com.liferay:com.liferay.object.web.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.32%, superiore al 25.3% delle vulnerabilità.
Correzione: aggiornare a 5.0.125, 1.0.65, 1.0.219, 2024.Q1.16 o successiva.

Package	Affected versions	Patched versions
com.liferay:com.liferay.frontend.js.web Maven	`< 5.0.125`	`5.0.125`
com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type Maven	`< 1.0.65`	`1.0.65`
com.liferay:com.liferay.object.web Maven	`< 1.0.219`	`1.0.219`
digital experience platform liferay	`= 7.4≥ 2024.Q1.1, < 2024.Q1.16≥ 2024.q2.0, ≤ 2024.q2.13≥ 2024.q3.1, ≤ 2024.q3.13≥ 2024.q4.0, ≤ 2024.q4.7≥ 2025.Q1.0, < 2025.Q1.6`	`2024.Q1.162025.Q1.6`
liferay portal liferay	`≥ 7.4.0, ≤ 7.4.3.132`	No fix yet

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-43758 · ADVISORY
liferay/liferay-portal commit bf03689 · WEB
liferay/liferay-portal commit ff4efcb · WEB
liferay/liferay-portal · PACKAGE
liferay.atlassian.net/browse/LPE-18186 · WEB
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43758 · WEB

Altre vulnerabilità di com.liferay:com.liferay.frontend.js.web

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In breve

CVE-2025-43758 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda com.liferay:com.liferay.frontend.js.web, com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type, com.liferay:com.liferay.object.web.

Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.32%, superiore al 25.3% delle vulnerabilità.

Correzione: aggiornare a 5.0.125, 1.0.65, 1.0.219, 2024.Q1.16 o successiva.

Package

Affected versions

Patched versions

com.liferay:com.liferay.frontend.js.web

Maven

< 5.0.125

5.0.125

com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type

Maven

< 1.0.65

1.0.65

com.liferay:com.liferay.object.web

Maven

< 1.0.219

1.0.219

digital experience platform

liferay

= 7.4≥ 2024.Q1.1, < 2024.Q1.16≥ 2024.q2.0, ≤ 2024.q2.13≥ 2024.q3.1, ≤ 2024.q3.13≥ 2024.q4.0, ≤ 2024.q4.7≥ 2025.Q1.0, < 2025.Q1.6

2024.Q1.162025.Q1.6

liferay portal

liferay

≥ 7.4.0, ≤ 7.4.3.132

No fix yet

Description

NVD description