CVE-2025-43797: 
Java vulnerability analysis and mitigation

CVE-2025-43797 is a security vulnerability discovered in Liferay Portal and Liferay DXP, first disclosed on September 15, 2025. The vulnerability affects multiple versions including Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions (Liferay Advisory).

The vulnerability stems from an insecure default initialization of resources (CWE-1188), where the default membership type of a newly created site is set to "Open". The vulnerability has been assigned a CVSS v4.0 score of 5.3 (Medium), with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (NVD).

The vulnerability allows any registered users to become a member of newly created sites. Once an attacker gains site membership, they can potentially view, add, or edit content on the affected site, leading to unauthorized access and potential data manipulation (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.112, Liferay DXP versions 2024.Q1.1, 2023.Q4.1, 2023.Q3.5, and Liferay DXP 7.3 U36. Organizations should upgrade to these patched versions to address the vulnerability (Liferay Advisory).