CVE-2025-43767

EPSS 0.18%
Veröffentlicht 23.08.2025 03:41:34
Zuletzt bearbeitet 12.12.2025 20:09:54
Erkennungen
Login

Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 11 VulnDex Vulnerability Enrichment 2

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version >= 2024.Q1.1 < 2024.Q1.13

Liferay ≫ Digital Experience Platform Version >= 2024.q2.0 <= 2024.q2.13

Liferay ≫ Digital Experience Platform Version >= 2024.Q3.1 < 2024.Q3.10

Liferay ≫ Digital Experience Platform Version 7.4 Update update86

Liferay ≫ Digital Experience Platform Version 7.4 Update update87

Liferay ≫ Digital Experience Platform Version 7.4 Update update88

Liferay ≫ Digital Experience Platform Version 7.4 Update update89

Liferay ≫ Digital Experience Platform Version 7.4 Update update90

Liferay ≫ Digital Experience Platform Version 7.4 Update update91

Liferay ≫ Digital Experience Platform Version 7.4 Update update92

Liferay ≫ Liferay Portal Version >= 7.4.3.86 < 7.4.3.132

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.18%	0.083

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security@liferay.com	5.1	0	0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43767

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-43767

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-43767

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-43767

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-43767