CVE-2025-43743 json
Liferay Portal Enumeration Discrepancy in Calendars
published 2025-08-19 14 mo ago modified 2026-06-17 4 mo ago also GHSA-g4vp-4gqr-7v8c , EUVD-2025-25221
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.
Patch / fix
- liferay digital_experience_platform 2024.Q1.16, 2025.Q1.6
- github.com/liferay/liferay-portal@0252814 commit
- github.com/liferay/liferay-portal@144e4a2 commit
- github.com/liferay/liferay-portal@1513ed2 commit
- github.com/liferay/liferay-portal@1e36820 commit
- github.com/liferay/liferay-portal@7d6e1bc commit
- github.com/liferay/liferay-portal@9a88f7f commit
- github.com/liferay/liferay-portal@9aba859 commit
- github.com/liferay/liferay-portal@bd89933 commit
- github.com/liferay/liferay-portal@d999a8e commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.4.0-ga1, <=7.4.3.132-ga132 |
no fix listed |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/liferay/liferay-portal/commit/02528147664475cd9f7205cd8bc05dfd43832201
web
-
github.com
/liferay/liferay-portal/commit/144e4a276e456c4b7a0831ff038241f82a9181db
web
-
github.com
/liferay/liferay-portal/commit/1513ed29f830c9119ee6be623ae783e545da4845
web
-
github.com
/liferay/liferay-portal/commit/1e368205c710403e76749e38127419780acdda9d
web
-
github.com
/liferay/liferay-portal/commit/7d6e1bccb62a41e944e0459d2c4b1eb9fdb31b8e
web
-
github.com
/liferay/liferay-portal/commit/9a88f7fa98f9fc11a9eab444a256204cccc82b77
web
-
github.com
/liferay/liferay-portal/commit/9aba859a6956786bcd8ce434ef063eed01b5ec6e
web
-
github.com
/liferay/liferay-portal/commit/bd89933cc9022a98fc34b562ce3573a58f14cf38
web
-
github.com
/liferay/liferay-portal/commit/d999a8e1902e88fdd7a26758f137925d969a639d
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43743
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18206
web
Sources
- CVE List CVE-2025-43743
- GitHub Advisory GHSA-g4vp-4gqr-7v8c
- NVD CVE-2025-43743
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.