Liferay Portal versions 7.4.0 through 7.4.3.132 and Liferay DXP versions 2025.Q1.0 through 2025.Q1.5, among others, allow any authenticated remote user to view other users’ calendars. This vulnerability enables attackers to enumerate user names, potentially leading to phishing attacks against those users.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-43743 |
Exploitation
To exploit this vulnerability, an attacker must be an authenticated user on the Liferay Portal. Once authenticated, the attacker can enumerate the names of other users, which can be used to craft targeted phishing attacks against those users, potentially leading to further compromise.
Affected Products
- Liferay Portal 7.4.0 to 7.4.3.132: A web platform for building digital experiences.
- Liferay DXP 2025.Q1.0 to 2025.Q1.5: A digital experience platform for creating personalized user experiences.
- Liferay DXP 2024.Q4.0 to 2024.Q4.7: A version of the DXP with similar vulnerabilities.
- Liferay DXP 2024.Q3.1 to 2024.Q3.13: Another affected version of the DXP.
- Liferay DXP 2024.Q2.0 to 2024.Q2.13: Affected version of the DXP.
- Liferay DXP 2024.Q1.1 to 2024.Q1.15: Another affected version of the DXP.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of Liferay Portal or DXP that addresses this issue. Additionally, organizations should implement strict access controls and monitor user activities to prevent unauthorized access.