CVE-2025-43810
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-43810. We'll provide specific mitigation strategies based on your environment and risk profile.
Description
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
Available Exploits
Related News
Affected Products
EU Vulnerability Database
Monitored by ENISA for EU cybersecurity
ENISA Analysis
Malicious code in bioql (PyPI)
Affected Products (ENISA)
ENISA Scoring
CVSS Score (4.0)
EPSS Score
ENISA References
Data provided by ENISA EU Vulnerability Database. Last updated: October 3, 2025
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Liferay Portal and DXP allows users to add a note to a different virtual instance
GHSA-f372-9rcj-8w2cAdvisory Details
Affected Packages
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
Advisory provided by GitHub Security Advisory Database. Published: September 23, 2025, Modified: September 23, 2025