CVE-2025-43786: 
Java vulnerability analysis and mitigation

Enumeration of ERC (Entity Resource Class) from object entry vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP versions (2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92) allows attackers to determine existent ERC in the application by exploiting the time response. The vulnerability was disclosed on September 9, 2025 and assigned CVE-2025-43786 with a CVSS v4.0 score of 6.9 (Medium) (Liferay Security).

The vulnerability is characterized by its network attack vector (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), no user interaction needed (UI:N), low vulnerability confidentiality impact (VC:L), and no impact on integrity (VI:N) or availability (VA:N). The CVSS v4.0 vector string is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (AttackerKB).

The vulnerability allows attackers to enumerate Entity Resource Classes (ERC) in the application by exploiting timing differences in responses. This information disclosure could potentially be used for further targeted attacks against the system (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.129 and Liferay DXP versions 2024.Q1.13, 2024.Q3.2, and 2024.Q4.0. Organizations should upgrade to these or later versions to mitigate the vulnerability (Liferay Security).