{"id":"GHSA-f372-9rcj-8w2c","summary":"Liferay Portal and DXP allows users to add a note to a different virtual instance","details":"Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.","aliases":["CVE-2025-43810"],"modified":"2025-09-23T15:42:31.228485Z","published":"2025-09-23T00:32:03Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-09-23T15:10:51Z","nvd_published_at":"2025-09-22T23:15:37Z","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43810"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/72259fbf5a81596e99b615df480dee0b0fa3aa09"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/9fad6a23b3c04146ef80a59b056f24b17cc2e721"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.atlassian.net/browse/LPE-17935"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43810"}],"affected":[{"package":{"name":"com.liferay.commerce:com.liferay.commerce.service","ecosystem":"Maven","purl":"pkg:maven/com.liferay.commerce/com.liferay.commerce.service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.164"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.27","10.0.28","10.0.29","10.0.3","10.0.30","10.0.31","10.0.32","10.0.33","10.0.34","10.0.35","10.0.36","10.0.37","10.0.38","10.0.39","10.0.4","10.0.40","10.0.41","10.0.42","10.0.43","10.0.44","10.0.45","10.0.46","10.0.47","10.0.48","10.0.49","10.0.5","10.0.50","10.0.51","10.0.52","10.0.53","10.0.54","10.0.55","10.0.56","10.0.57","10.0.58","10.0.59","10.0.6","10.0.60","10.0.61","10.0.62","10.0.63","10.0.64","10.0.65","10.0.66","10.0.67","10.0.68","10.0.69","10.0.7","10.0.70","10.0.71","10.0.72","10.0.73","10.0.74","10.0.75","10.0.76","10.0.77","10.0.78","10.0.79","10.0.8","10.0.80","10.0.9","11.0.0","11.0.1","11.0.10","11.0.100","11.0.101","11.0.102","11.0.103","11.0.104","11.0.105","11.0.106","11.0.107","11.0.108","11.0.109","11.0.11","11.0.110","11.0.111","11.0.112","11.0.113","11.0.114","11.0.115","11.0.116","11.0.117","11.0.118","11.0.119","11.0.12","11.0.120","11.0.121","11.0.122","11.0.123","11.0.124","11.0.125","11.0.126","11.0.127","11.0.128","11.0.129","11.0.13","11.0.130","11.0.131","11.0.132","11.0.133","11.0.134","11.0.135","11.0.136","11.0.137","11.0.138","11.0.139","11.0.14","11.0.140","11.0.141","11.0.142","11.0.143","11.0.144","11.0.145","11.0.146","11.0.147","11.0.148","11.0.149","11.0.15","11.0.150","11.0.151","11.0.152","11.0.153","11.0.154","11.0.155","11.0.156","11.0.157","11.0.158","11.0.159","11.0.16","11.0.160","11.0.161","11.0.162","11.0.163","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.27","11.0.28","11.0.29","11.0.3","11.0.30","11.0.31","11.0.32","11.0.33","11.0.34","11.0.35","11.0.36","11.0.37","11.0.38","11.0.39","11.0.4","11.0.40","11.0.41","11.0.42","11.0.43","11.0.44","11.0.45","11.0.46","11.0.47","11.0.48","11.0.49","11.0.5","11.0.50","11.0.51","11.0.52","11.0.53","11.0.54","11.0.55","11.0.56","11.0.57","11.0.58","11.0.59","11.0.6","11.0.60","11.0.61","11.0.62","11.0.63","11.0.64","11.0.65","11.0.66","11.0.67","11.0.68","11.0.69","11.0.7","11.0.70","11.0.71","11.0.72","11.0.73","11.0.74","11.0.75","11.0.76","11.0.77","11.0.78","11.0.79","11.0.8","11.0.80","11.0.81","11.0.82","11.0.83","11.0.84","11.0.85","11.0.86","11.0.87","11.0.88","11.0.89","11.0.9","11.0.90","11.0.91","11.0.92","11.0.93","11.0.94","11.0.95","11.0.96","11.0.97","11.0.98","11.0.99","2.0.0","2.0.1","3.0.0","4.0.0","4.1.0","4.1.1","4.1.2","4.1.3","4.2.0","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.2.3","5.3.0","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","5.4.8","5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6","5.6.0","5.7.0","5.7.1","5.8.0","5.8.1","5.8.2","5.8.3","5.8.4","5.8.5","5.8.6","6.0.0","6.0.1","6.1.0","7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.1.0","7.1.1","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.1.0","8.1.1","8.1.10","8.1.11","8.1.12","8.1.13","8.1.14","8.1.15","8.1.16","8.1.17","8.1.18","8.1.19","8.1.2","8.1.20","8.1.21","8.1.22","8.1.23","8.1.24","8.1.25","8.1.26","8.1.27","8.1.28","8.1.29","8.1.3","8.1.30","8.1.31","8.1.32","8.1.33","8.1.34","8.1.35","8.1.36","8.1.37","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.24","9.0.25","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-f372-9rcj-8w2c/GHSA-f372-9rcj-8w2c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}