CVE-2025-43763: digital experience platform from 2024.q1.1 (inclusive), before 2024.q1.21 (exclusive), from 2024.q2.0 (inclusive)…

Affected technology

digital experience platform · from 2024.q1.1 (inclusive), before 2024.q1.21 (exclusive)
liferay

digital experience platform · from 2024.q2.0 (inclusive), through 2024.q2.13 (inclusive)
liferay

digital experience platform · from 2024.Q3.0 (inclusive), through 2024.Q3.13 (inclusive)
liferay

digital experience platform · from 2024.q4.0 (inclusive), through 2024.q4.7 (inclusive)
liferay

liferay portal · from 7.4.0 (inclusive), before 7.4.3.132 (exclusive)
liferay

Portal · 7.4.0 through 7.4.3.131
Liferay

DXP · 2024.Q1.1 through 2024.Q1.20, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7
Liferay

Description’s affected range: through 7.4.3.131

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · Passive user interaction

What an attacker can do

An attacker can manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.