N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43739

CVE-2025-43739: Liferay Portal Email Modification Vulnerability via Calendar Portlet

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent through the calendar portlet, allowing an attacker to send phishing emails to any other user in the same organization.

Liferay Portal is fixed on the master branch from commit ff18e7d.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43739

CVE-2025-43739:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.calendar.service	maven	< 6.0.83	6.0.83

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis indicates a missing authorization vulnerability in the Liferay Portal's calendar portlet. The root cause was the absence of a permission check in the updateCalendarNotificationTemplate method within the CalendarNotificationTemplateServiceImpl class. This flaw allowed any authenticated user to modify the content of email templates used for calendar notifications, which could be leveraged for phishing attacks against other users in the same organization.

The fix, distributed across multiple commits, addresses this by introducing a comprehensive permission model for the CalendarNotificationTemplate entity. The key changes were:

Introduction of a specific permission checker: A new class, CalendarNotificationTemplateModelResourcePermission, was created to handle permission checks (like UPDATE) for CalendarNotificationTemplate objects (commit f238677d).
Enforcing the permission check: The updateCalendarNotificationTemplate method was modified to use this new permission checker, effectively closing the security hole (commit f238677d).
Resource Association: The addCalendarNotificationTemplate and deleteCalendarNotificationTemplate methods in CalendarNotificationTemplateLocalServiceImpl were updated to correctly manage the lifecycle of security resources associated with the templates (commits 7d70fab and ff18e7d).
Data Migration: An upgrade process was added to apply these new security permissions to all existing CalendarNotificationTemplate records in the database (commit a01a99cc).
Validation: New integration tests were written to confirm that any attempt to update a notification template without the required permissions results in a PrincipalException, thus verifying the fix (commit b396c00).

Based on this evidence, the function com.liferay.calendar.service.impl.CalendarNotificationTemplateServiceImpl.updateCalendarNotificationTemplate is the specific runtime indicator that would appear in a profiler or stack trace during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.