Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.1, among others, allow unauthenticated users to access files uploaded via URL in the document library. This vulnerability poses a risk to the confidentiality of sensitive information stored in the system. Users should be aware of the potential for unauthorized access to their documents.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-43749 |
Exploitation
To exploit this vulnerability, an attacker can access the Liferay Portal or DXP system as an unauthenticated user and construct a URL to access files stored in the document library. This can lead to unauthorized viewing or downloading of sensitive documents.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: A web platform for building digital experiences.
- Liferay DXP 2025.Q1.0 through 2025.Q1.1: A digital experience platform that provides tools for creating and managing web applications.
- Liferay DXP 2024 versions: Various updates that may also be affected by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Liferay Portal or DXP that addresses this issue. Additionally, implementing access controls and ensuring that sensitive files are not publicly accessible can help reduce the risk of unauthorized access.