CVE-2025-43797: 
Java vulnerability analysis and mitigation

CVE-2025-43797 is a security vulnerability discovered in Liferay Portal and Liferay DXP platforms. The vulnerability was disclosed on September 15, 2025, and affects multiple versions including Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions (Liferay Advisory).

The vulnerability stems from an insecure default initialization of resource (CWE-1188), where the default membership type of a newly created site is set to "Open". The vulnerability has been assigned a CVSS v4.0 score of 5.3 (Medium) with the vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (Liferay Advisory).

The vulnerability allows any registered users to become a member of newly created sites by default. Once an attacker gains site membership, they can potentially view, add, or edit content on the affected site (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal 7.4.3.112, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.1, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 U36. Organizations using affected versions should upgrade to these patched versions (Liferay Advisory).