CVE-2025-43789: 
Liferay Portal 脆弱性の分析と軽減

JSON Web Services vulnerability (CVE-2025-43789) affects Liferay Portal versions 7.4.0 through 7.4.3.119 and Liferay DXP versions 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92. The vulnerability was disclosed on April 15, 2025, and involves JSON Web Services published to OSGi being registered and invoked directly as classes, which allows Service Access Policies to be executed (Liferay Advisory).

The vulnerability has been assigned a CVSS v4.0 base score of 1.0 (LOW) with the vector string CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-863 (Incorrect Authorization). The technical issue stems from JSON Web Services being registered and invoked directly as classes within the OSGi framework, potentially leading to unauthorized execution of Service Access Policies (NVD Database).

The vulnerability has low severity impact with limited potential for confidentiality and integrity breaches. According to the CVSS metrics, the vulnerability requires user interaction and has adjacent network attack vector, indicating that exploitation would require specific conditions to be met (NVD Database).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal version 7.4.3.120 or Liferay DXP versions 2024.Q1.10, 2024.Q2.0, 2024.Q3.0, or 2024.Q4.0 (Liferay Advisory).