IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-15 21:15

MODIFIED

2025-09-16 12:49

EPSS (Prob. Exploit)

0.26%

Top 82.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-43xf-59vr-g4f2 MODERATE

Liferay Portal Uses Default Password

AFFECTED PACKAGES:

MAVEN / com.liferay.portal:release.portal.bom

>= 7.4.0, < 7.4.3.112

Fixed in: 7.4.3.112

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

56 versions affected

ALIASES:

GHSA-43xf-59vr-g4f2

> HISTORIQUE DES MODIFICATIONS

Première apparition

15/09/2025 21:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui