CVE-2025-43772: Portal 7.0.0 through 7.4.3.5; +1 more affected products

Affected technology

Portal · 7.0.0 through 7.4.3.5
Liferay

DXP · 6.2.0 through portal-173, 7.0.10 through de-102, 7.1.10 through dxp-28, 7.2.10 through dxp-20, 7.3.10 through 7.3.10-u27, 7.4.13 through 7.4.13-u1
Liferay

Description’s affected range: through 7.4.3.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Remote attackers can consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and integrity impact as none; availability impact as high.