Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.6, among others, allow any authenticated user to modify the content of emails sent through the calendar portlet. This vulnerability enables attackers to send phishing emails to other users within the same organization.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-43739 |
Exploitation
To exploit this vulnerability, an attacker must be an authenticated user of the Liferay Portal. Once authenticated, the attacker can manipulate the email content sent through the calendar portlet, potentially crafting phishing emails that appear legitimate to other users within the organization.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.132: A web platform for building digital experiences.
- Liferay DXP 2025.Q1.0 through 2025.Q1.6: A digital experience platform for creating and managing web applications.
- Liferay DXP 2024.Q4.0 through 2024.Q4.7: A version of the digital experience platform with similar vulnerabilities.
- Liferay DXP 2024.Q3.1 through 2024.Q3.13: Another affected version of the platform.
- Liferay DXP 2024.Q2.0 through 2024.Q2.13: Affected version with the same vulnerability.
- Liferay DXP 2024.Q1.1 through 2024.Q1.16: Also vulnerable to this issue.
- Liferay Portal 7.4 GA through update 92: The general availability version is also impacted.
Mitigation
To mitigate this vulnerability, it is recommended that organizations restrict access to the calendar portlet and implement strict user authentication measures. Additionally, users should be educated about the risks of phishing and encouraged to verify the authenticity of emails received from the calendar portlet.