Medium severity6.5NVD Advisory· Published Sep 15, 2025· Updated Jun 17, 2026
CVE-2025-43798
CVE-2025-43798
Description
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.multi.factor.authentication.timebased.otp.webMaven | < 2.0.25 | 2.0.25 |
Affected products
46- ghsa-coordsRange: < 2.0.25
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 43 more
- cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: >=2023.q3.1,<2023.q3.5
- cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_2:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-4p5r-3jmm-652qghsaADVISORY
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-43798ghsaADVISORY
- github.com/liferay/liferay-portal/commit/1df25e46675afe7c3a2754bf8968bcb9677db950ghsaWEB
News mentions
0No linked articles in our index yet.