N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43786

CVE-2025-43786: Liferay Portal exposes ERC which can lead to exploit the time response attack

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43786

CVE-2025-43786:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.vulcan.impl	maven	>= 5.0.7, < 5.0.127	5.0.127
com.liferay:com.liferay.headless.admin.workflow.impl	maven	>= 5.0.4, < 5.0.83	5.0.83
com.liferay:com.liferay.portal.workflow.api	maven	>= 7.0.1, < 11.0.1	11.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a timing attack (CWE-208) that allows an attacker to enumerate External Reference Codes (ERCs) in Liferay Portal. The root cause is inconsistent handling of different error conditions, specifically 'resource not found' versus 'permission denied'. An attacker could measure the server's response time to distinguish between these cases and thereby determine if a resource exists.

The analysis of the provided patches reveals a coordinated effort to remediate this by unifying the application's response to these different error states:

Standardizing 'Not Found' Exceptions: The NoSuchWorkflowDefinitionException, which was thrown when a specific workflow was not found, was made a subclass of the more generic NoSuchModelException. This allowed it to be handled by a centralized mapper, and its own specific, vulnerable mapper (NoSuchWorkflowDefinitionExceptionMapper) was removed.
Masking Permissions Errors: The PrincipalExceptionMapper, which handles permission errors, was modified. For GET requests, it now throws a NotFoundException instead of returning a Forbidden status. This makes a permission-denied error appear identical to a not-found error, preventing an attacker from distinguishing between the two.
Unifying Response Generation: Both NoSuchModelExceptionMapper and PrincipalExceptionMapper were updated to delegate to the standard NotFoundExceptionMapper. This ensures that the HTTP response (status code, headers, and body) is identical in all three scenarios (not found, model not found, and permission denied on GET).
Removing Information Leakage: The NotFoundExceptionMapper itself was patched to stop including the exception message in the response body, preventing any potential information leakage.

The identified vulnerable functions are the specific exception mappers that, prior to the patches, created distinguishable responses for different error conditions. The _getWorkflowDefinition function is also included as it is the source of the exception that triggers the vulnerable handling path. By exploiting the differences in how these functions handled exceptions, an attacker could successfully carry out the timing attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.