CVE-2025-43792
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Liferay Portal and Liferay DXP do not properly obtain the remote address of the live site from the database, allowing remote authenticated users to exfiltrate data to an attacker-controlled server (a fake "live site") via the _com_liferay_exportimport_web_portlet_ExportImportPortlet_remoteAddress and _com_liferay_exportimport_web_portlet_ExportImportPortlet_remotePort parameters. To exploit, an attacker must also obtain the staging server's shared secret and add the attacker-controlled server to the staging server's whitelist.
Risk Assessment
An authenticated attacker can exfiltrate data to an external server, potentially leading to leakage of sensitive information. However, this requires additional conditions such as knowledge of the shared secret and modification of the whitelist.
Recommendation
Update Liferay Portal and DXP to versions containing the fix. Regularly review the staging server whitelist and protect shared secrets.
Other vulnerabilities in Liferay Portal / Liferay DXP
See all- CVE-2025-62254High
The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size of files it combines. A remote attacker can craft URL query strings to generate very large responses, leading to a denial of service attack.
- CVE-2025-62255Medium
Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions, are vulnerable to self-XSS on the edit Knowledge Base article page. A remote attacker can inject arbitrary script or HTML via a crafted payload in an attachment's filename.
- CVE-2025-62247Medium
Missing authorization in the Collection Provider component of Liferay Portal and Liferay DXP. Instance users can read and select unauthorized Blueprints across instances.
- CVE-2025-62248Medium
A reflected cross-site scripting (XSS) vulnerability, caused by a regression, was identified in Liferay Portal and Liferay DXP. A remote authenticated attacker can inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter, and the malicious payload executes in the victim's browser when they access a crafted URL.
- CVE-2025-62251Medium
The Menu Display Widget in Liferay Portal and Liferay DXP shows content to users who lack permission to view it. This could expose sensitive information to unauthorized users.
- CVE-2025-62252Medium
An IDOR vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
- CVE-2025-62243Medium
An insecure direct object reference (IDOR) and improper permission check vulnerability exists in Publications in Liferay Portal and Liferay DXP. A remote authenticated attacker can view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter and edit comments via crafted URLs.
- CVE-2025-62244Medium
An insecure direct object reference (IDOR) vulnerability exists in the Publications module of Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. A remote authenticated attacker can view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.
- CVE-2025-62245Medium
Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.
- CVE-2025-62239Medium
A cross-site scripting (XSS) vulnerability in the workflow process builder in Liferay Portal and Liferay DXP allows remote authenticated attackers to inject arbitrary web script or HTML via crafted input in a workflow definition.
Original NVD description (English source)
Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly obtain the remote address of the live site from the database which, which allows remote authenticated users to exfiltrate data to an attacker controlled server (i.e., a fake “live site”) via the _com_liferay_exportimport_web_portlet_ExportImportPortlet_remoteAddress and _com_liferay_exportimport_web_portlet_ExportImportPortlet_remotePort parameters. To successfully exploit this vulnerability, an attacker must also successfully obtain the staging server’s shared secret and add the attacker controlled server to the staging server’s whitelist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS