CVE-2025-43773: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2025-43773) was identified in Liferay Portal and Liferay DXP, discovered and disclosed on August 29, 2025. The vulnerability affects multiple versions including Liferay Portal 7.4.0 through 7.4.3.132, and various Liferay DXP versions from 2024.Q1.1 through 2025.Q2.0, allowing improper access through the expandoTableLocalService (Liferay Advisory).

The vulnerability is classified with a CVSS v4.0 Base Score of 4.6 (Medium) with the following vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The technical assessment indicates that it requires network access (AV:N), has low attack complexity (AC:L), requires high privileges (PR:H), and active user interaction (UI:A). The vulnerability is associated with CWE-862 (Missing Authorization) (NVD Database, Liferay Advisory).

The vulnerability results in low-level impacts across multiple security aspects, including confidentiality (VC:L), integrity (VI:L), and subsequent system confidentiality (SC:L) and integrity (SI:L), with no impact on availability. The vulnerability allows for improper access through the expandoTableLocalService, potentially leading to security policy bypass (CERT-FR).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay DXP 2025.Q2.1, DXP 2025.Q1.15, DXP 2024.Q1.19, or the latest fixed version on the Liferay Portal master branch (Liferay Advisory).