VIR Vulnerability Intelligence Relay

CVE-2025-43736

unknown
Published 2025-08-12 · Modified 2025-08-12
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
—

Description

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Package impact
EcosystemPackageVulnerableFixed
java Mavencom.liferay.portal:release.portal.bom>=7.4.3.0,<=7.4.3.132
java Mavencom.liferay.portal:release.dxp.bom>=2025.Q1.0,<2025.Q1.92025.Q1.9
java Mavencom.liferay.portal:release.dxp.bom>=2024.Q4.0,<=2024.Q4.7
java Mavencom.liferay.portal:release.dxp.bom>=2024.Q3.0,<=2024.Q3.13
java Mavencom.liferay.portal:release.dxp.bom>=2024.Q2.0,<=2024.Q2.13
java Mavencom.liferay.portal:release.dxp.bom>=2024.Q1.0,<2024.Q1.172024.Q1.17
java Mavencom.liferay.portal:release.dxp.bom<=7.4.13.u92
java Mavencom.liferay:com.liferay.frontend.taglib<13.10.013.10.0
java Mavencom.liferay:com.liferay.image.uploader.web<5.0.565.0.56
java Mavencom.liferay:com.liferay.users.admin.web<11.0.2711.0.27
java Mavencom.liferay:com.liferay.account.admin.web<2.0.1382.0.138

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.