N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43810

CVE-2025-43810: Liferay Portal and DXP allows users to add a note to a different virtual instance

Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43810

CVE-2025-43810:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.commerce:com.liferay.commerce.service	maven	< 11.0.164	11.0.164

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) within Liferay Portal's commerce module, specifically affecting how notes on orders are handled in a multi-tenant setup. Authenticated users from one virtual instance could perform actions (add, delete, view, update) on order notes belonging to a different virtual instance.

The root cause of this vulnerability was the improper use of permission checks within the com.liferay.commerce.service.impl.CommerceOrderNoteServiceImpl class. Several methods in this service, such as addCommerceOrderNote, deleteCommerceOrderNote, and getCommerceOrderNotes, relied on _portletResourcePermission.check. This permission check was not sufficient as it failed to validate that the commerceOrderId being acted upon belonged to the same virtual instance as the user making the request. This allowed a malicious user to craft a request with a commerceOrderId from a different tenant and bypass the intended security boundaries.

The security patch, primarily in commit 9fad6a23b3c04146ef80a59b056f24b17cc2e721, addresses this flaw by systematically replacing the weak _portletResourcePermission.check with the more robust _commerceOrderModelResourcePermission.check. This corrected check properly validates permissions at the model level, ensuring that the user has the explicit right to access the specific CommerceOrder entity, thereby closing the IDOR gap. During an exploit, a runtime profiler would capture calls to these methods within CommerceOrderNoteServiceImpl as they are the direct entry points for the vulnerable operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.