The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43808 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · liferayNVD modified 2026-10-18 21:10
Affected (CPE criteria) 132
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update36:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*- and 92 more