CVE-2025-43751 json
Liferay Portal User Enumeration Vulnerability via the Create Account Page
published 2025-08-22 14 mo ago modified 2026-06-17 4 mo ago also GHSA-xwc5-q44v-p6gg , EUVD-2025-25583
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.
Patch / fix
- maven com.liferay:com.liferay.login.web 6.0.66
- liferay digital_experience_platform 2024.Q1.15
- github.com/liferay/liferay-portal@097597e commit
- github.com/liferay/liferay-portal@1205e7b commit
- github.com/liferay/liferay-portal@4843e00 commit
- github.com/liferay/liferay-portal@4987ff8 commit
- github.com/liferay/liferay-portal@4f3b52b commit
- github.com/liferay/liferay-portal@6091046 commit
- github.com/liferay/liferay-portal@7b83767 commit
- github.com/liferay/liferay-portal@7e9e29a commit
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.login.web | <6.0.66 |
6.0.66 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/liferay/liferay-portal/commit/097597e31b596295cb993bac596a42f06ac1e6d8
web
-
github.com
/liferay/liferay-portal/commit/1205e7bbcc31c40180935044d39ebf158b5256e1
web
-
github.com
/liferay/liferay-portal/commit/4843e000995ef5fbe4e4f14dce23c2f3116940de
web
-
github.com
/liferay/liferay-portal/commit/4987ff8641b970db3dca14d75bb9687120107c3b
web
-
github.com
/liferay/liferay-portal/commit/4f3b52bc92875cd0a0958ea33dece09b8224e6dc
web
-
github.com
/liferay/liferay-portal/commit/609104647a5a0bb79627ef689a2f8dc9fe9fbb05
web
-
github.com
/liferay/liferay-portal/commit/7b8376791cfe22bfce14e5f241af1d158d535fd8
web
-
github.com
/liferay/liferay-portal/commit/7e9e29a9dac8e5b6db6f2a480c98b483584b2f87
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43751
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43751
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-18203
web
Sources
- CVE List CVE-2025-43751
- GitHub Advisory GHSA-xwc5-q44v-p6gg
- NVD CVE-2025-43751
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.