GHSA-xvgg-9h29-4g34 CVE-2025-43793
Liferay Portal has Improper Validation of Specified Quantity in Input
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.40%
- Chance of exploitation in the next 30 days. Higher than 34.82% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1284 Improper Validation of Specified Quantity in Input
- Fix
- Available
- 2 packages have a fixed version
Description
Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read cookies set by the application.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.liferay.portal:com.liferay.portal.impl | < 96.0.0 |
96.0.0 |
| com.liferay.portal:com.liferay.portal.kernel | < 130.0.1 |
130.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
com.liferay.portal:com.liferay.portal.impl Maven → 96.0.0
- maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>com.liferay.portal.impl</artifactId><version>96.0.0</version></dependency>- gradle
implementation("com.liferay.portal:com.liferay.portal.impl:96.0.0")
com.liferay.portal:com.liferay.portal.kernel Maven → 130.0.1
- maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>com.liferay.portal.kernel</artifactId><version>130.0.1</version></dependency>- gradle
implementation("com.liferay.portal:com.liferay.portal.kernel:130.0.1")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-1284: Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2020-7961 Deserialization of Untrusted Data in Liferay Portal | Critical Known exploited | Also affects com.liferay.portal:com.liferay.portal.kernel |
| GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-rx48-gqc2-4w47 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-pfwq-mr9g-gq6m Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-2hm7-r8f3-423h Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-697h-3q6m-jwp4 Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor