N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43784

CVE-2025-43784: Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43784

CVE-2025-43784:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.headless.builder.impl	maven	< 1.0.32	1.0.32

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit ccbae813d4a9ec66597191f58d1cb4137f264c99) reveals an improper access control vulnerability within the ObjectEntryHelper class. The root cause was the explicit setting of the permission checker to the user who created the objectDefinition. Since these definitions are typically created by administrators, any user invoking the API endpoints that used these helper methods would temporarily gain administrative privileges for the scope of the request.

The vulnerable functions, getObjectEntriesPage and getObjectEntry, contained code that set a new permission checker using PermissionThreadLocal.setPermissionChecker(). This action effectively escalated the privileges of the caller (e.g., a guest user) to that of the object definition's owner. This allowed unauthorized access to object entry information through the API Builder.

The patch rectifies this vulnerability by removing the lines of code responsible for the privilege escalation from the ObjectEntryHelper.java file. As a result, the application now correctly uses the permission context of the user making the API request, enforcing proper access control. The changes in APIApplicationPublisherPortalInstanceLifecycleListener.java are part of the fix, ensuring that elevated permissions are used only for a specific, legitimate administrative task during startup, and not for general API calls.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.