VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026

CVE-2025-43786

CVE-2025-43786

Description

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.portal.vulcan.implMaven
>= 5.0.7, < 5.0.1275.0.127
com.liferay:com.liferay.headless.admin.workflow.implMaven
>= 5.0.4, < 5.0.835.0.83
com.liferay:com.liferay.portal.workflow.apiMaven
>= 7.0.1, < 11.0.111.0.1

Affected products

100
  • Liferay/Digital Experience Platform94 versions
    cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 93 more
    • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: >=2024.Q1.1,<2024.Q1.13
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.0,<7.4.3.129
    • (no CPE)range: 7.4.0
  • ghsa-coords3 versions
    pkg:maven/com.liferay/com.liferay.headless.admin.workflow.implpkg:maven/com.liferay/com.liferay.portal.vulcan.implpkg:maven/com.liferay/com.liferay.portal.workflow.api
    >= 5.0.4, < 5.0.83+ 2 more
    • (no CPE)range: >= 5.0.4, < 5.0.83
    • (no CPE)range: >= 5.0.7, < 5.0.127
    • (no CPE)range: >= 7.0.1, < 11.0.1
  • Liferay/DXPcpe-rescue
    Range: 7.4.13

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.