CVE-2025-43814 json
Liferay Portal and DXP audit events record password reminder answers
published 2025-09-22 13 mo ago modified 2026-10-18 21 d ago also GHSA-ph63-chvv-8x46 , EUVD-2025-30441
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated users to obtain a user’s password reminder answer via the audit events.
Patch / fix
- maven com.liferay:com.liferay.portal.security.audit.event.generators.user.management 5.0.13
- liferay digital_experience_platform 2023.Q4.9
- liferay liferay_portal 7.4.3.113
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.portal.security.audit.event.generators.user.management | <5.0.13 |
5.0.13 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-201 Insertion of Sensitive Information Into Sent Data
References
-
github.com
/liferay/liferay-portal/commit/6d0f123c838b96fd71fb97f422366ffa43391121
web
-
github.com
/liferay/liferay-portal/commit/76c9c38f21614bf0dca877057b13f6a449c041e8
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43814
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-43814
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17937
web
Sources
- CVE List CVE-2025-43814
- GitHub Advisory GHSA-ph63-chvv-8x46
- NVD CVE-2025-43814
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.