CVE-2025-43814: 
Java vulnerability analysis and mitigation

CVE-2025-43814 is a security vulnerability discovered in Liferay Portal and Liferay DXP that was published on September 22, 2025. The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.112 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 (Liferay Advisory).

The vulnerability is related to the exposure of sensitive information where audit events record a user's password reminder answer. It has been assigned a CVSS v4.0 score of 6.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) (NVD).

The vulnerability allows remote authenticated users to obtain other users' password reminder answers through audit events. This exposure of sensitive information could potentially be used in account recovery attacks or social engineering attempts (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal version 7.4.3.113, Liferay DXP version 2024.Q2.0, 2024.Q1.1, or 2023.Q4.9 (Liferay Advisory).