VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 19, 2025· Updated Jun 17, 2026

CVE-2025-43808

CVE-2025-43808

Description

The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.commerce:com.liferay.commerce.product.type.virtual.serviceMaven
< 4.0.474.0.47

Affected products

135
  • Liferay/Digital Experience Platform131 versions
    cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 130 more
    • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: >=2023.Q3.1,<=2023.Q3.10
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update36:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.0,<7.4.3.113
    • (no CPE)range: 7.3.0
  • ghsa-coords
    pkg:maven/com.liferay.commerce/com.liferay.commerce.product.type.virtual.service
    Range: < 4.0.47
  • Liferay/DXPcpe-rescue
    Range: 7.3.10

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.