{"id":"GHSA-5pp7-m8x8-rc82","summary":"Liferay Portal allows remote attackers to view display page templates via crafted URLs","details":"Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.","aliases":["CVE-2025-43805"],"modified":"2025-09-17T19:59:18.933880Z","published":"2025-09-17T00:31:11Z","database_specific":{"cwe_ids":["CWE-862"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-09-17T19:14:47Z","nvd_published_at":"2025-09-16T22:15:33Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43805"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal/compare/7.4.3.111-ga111...7.4.3.112-ga112"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805"}],"affected":[{"package":{"name":"com.liferay:com.liferay.asset.display.page.service","ecosystem":"Maven","purl":"pkg:maven/com.liferay/com.liferay.asset.display.page.service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.55"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.46","1.0.47","1.0.48","1.0.49","1.0.5","1.0.50","1.0.51","1.0.6","1.0.7","1.0.8","1.0.9","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.20","2.1.21","2.1.22","2.1.23","2.1.24","2.1.25","2.1.26","2.1.27","2.1.28","2.1.29","2.1.3","2.1.30","2.1.31","2.1.32","2.1.33","2.1.34","2.1.35","2.1.36","2.1.37","2.1.38","2.1.39","2.1.4","2.1.40","2.1.41","2.1.42","2.1.43","2.1.44","2.1.45","2.1.46","2.1.47","2.1.48","2.1.49","2.1.5","2.1.50","2.1.51","2.1.52","2.1.53","2.1.54","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.21","3.0.22","3.0.23","3.0.24","3.0.25","3.0.26","3.0.27","3.0.28","3.0.29","3.0.3","3.0.30","3.0.31","3.0.32","3.0.33","3.0.34","3.0.35","3.0.36","3.0.37","3.0.38","3.0.39","3.0.4","3.0.40","3.0.41","3.0.42","3.0.43","3.0.44","3.0.45","3.0.46","3.0.47","3.0.48","3.0.49","3.0.5","3.0.50","3.0.51","3.0.52","3.0.6","3.0.7","3.0.8","3.0.9","4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.20","4.0.21","4.0.22","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.29","4.0.3","4.0.30","4.0.31","4.0.32","4.0.33","4.0.34","4.0.35","4.0.36","4.0.37","4.0.38","4.0.39","4.0.4","4.0.40","4.0.41","4.0.42","4.0.43","4.0.44","4.0.45","4.0.46","4.0.47","4.0.48","4.0.49","4.0.5","4.0.50","4.0.51","4.0.52","4.0.53","4.0.54","4.0.6","4.0.7","4.0.8","4.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-5pp7-m8x8-rc82/GHSA-5pp7-m8x8-rc82.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}