CVE-2025-43808
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-43808. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
Available Exploits
Related News
Affected Products
EU Vulnerability Database
Monitored by ENISA for EU cybersecurity
ENISA Analysis
Malicious code in bioql (PyPI)
Affected Products (ENISA)
ENISA Scoring
CVSS Score (4.0)
EPSS Score
ENISA References
Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource
GHSA-chr3-w547-85hwAdvisory Details
Affected Packages
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
Advisory provided by GitHub Security Advisory Database. Published: September 19, 2025, Modified: September 19, 2025