DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Liferay Portal: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-08-24
Ein Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, Benutzer auf bösartige Websites umzuleiten und Cross-Site-Scripting-Angriffe durchzuführen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-43766US | critical9.8 | — | ||
The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through u… | ||||
| CVE-2025-43765US | medium6.1 | — | ||
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 20… | ||||
| CVE-2025-43764US | medium6.5 | — | ||
Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP… | ||||
| CVE-2025-43767US | medium6.1 | — | ||
Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 thro… | ||||
| CVE-2025-43769US | medium6.1 | — | ||
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 thro… | ||||
| CVE-2025-43768US | high7.7 | — | ||
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.… | ||||
| CVE-2025-43770US | medium6.1 | — | ||
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.… | ||||
| CVE-2025-43761US | medium6.1 | — | ||
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.… | ||||
| CVE-2025-43762US | medium6.5 | — | ||
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q… | ||||
| CVE-2025-43759US | low2.7 | — | ||
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q… | ||||
| CVE-2025-43758US | medium5.3 | — | ||
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q… | ||||
| CVE-2025-43760US | medium5.4 | — | ||
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q… | ||||
| CVE-2025-43751US | medium5.3 | — | ||
User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Liferay Security Advisory CVE-2025-43751 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43758 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43759 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43760 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43761 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43762 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43764 vom 2025-08-24external
- Liferay Security Advisory CVE-2025-43765 vom 2025-08-24external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan