CVE-2025-43739: 
Java vulnerability analysis and mitigation

CVE-2025-43739 is a security vulnerability affecting Liferay Portal 7.4.0 through 7.4.3.132 and multiple versions of Liferay DXP from 2024.Q1.1 through 2025.Q1.6. The vulnerability was discovered and disclosed on August 19, 2025. This security flaw allows authenticated users to modify email content sent through the calendar portlet, potentially enabling phishing attacks within the same organization (NVD, Liferay Security).

The vulnerability is classified as an Observable Discrepancy (CWE-203) with a CVSS v4.0 Base Score of 5.3 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no special privileges (PR:N) but does need user interaction (UI:P). The vulnerability impacts confidentiality and security at a low level (VC:L, SC:L) with no impact on integrity or availability (NVD).

The vulnerability allows authenticated attackers to modify the content of emails sent through the calendar portlet, enabling them to conduct phishing attacks targeting other users within the same organization. This could lead to potential security breaches through social engineering attacks (Liferay Security).

The vulnerability has been fixed in Liferay Portal master branch and Liferay DXP 2025.Q2.0 and 2025.Q1.7. Organizations are advised to upgrade to these fixed versions to mitigate the risk (Liferay Security).