CVE-2025-43743: Liferay DXP Information Disclosure Flaw

CVE-2025-43743 Overview

CVE-2025-43743 is an information disclosure vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows any authenticated remote user to view other users' calendars, which enables enumeration of usernames across the platform. Attackers can leverage the exposed identity data to craft targeted phishing campaigns against enumerated users. The issue is tracked under CWE-203: Observable Discrepancy and stems from insufficient access control on calendar visibility.

Critical Impact

Authenticated attackers can enumerate internal user identities across affected Liferay deployments, providing reconnaissance data to fuel targeted phishing and social engineering campaigns.

Affected Products

• Liferay Portal 7.4.0 through 7.4.3.132 (including 7.4 GA through update 92)
• Liferay DXP 2024.Q1.1 through 2024.Q1.15, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.1 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7
• Liferay DXP 2025.Q1.0 through 2025.Q1.5

Discovery Timeline

• 2025-08-19 - CVE-2025-43743 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43743

Vulnerability Analysis

The vulnerability resides in the Liferay Portal calendar component. Authenticated users can access calendar resources belonging to other users without proper authorization checks. Because calendars are associated with user accounts, iterating through calendar identifiers or names reveals the underlying user roster.

The attacker requires only low-privilege authenticated access to the portal. Exploitation is fully remote over the network and does not require user interaction. The result is disclosure of low-sensitivity but operationally valuable information — the list of valid usernames within the deployment.

Root Cause

The flaw is classified as CWE-203: Observable Discrepancy. Liferay's calendar module does not consistently enforce access controls when returning calendar metadata. Responses expose owner information for calendars that should be restricted, allowing an authenticated attacker to derive user identities through observation of calendar names.

Attack Vector

An authenticated attacker interacts with the calendar functionality through the standard portal interface or REST endpoints. By enumerating available calendars, the attacker collects associated user names. Once a directory of valid users is compiled, the attacker can send targeted phishing messages that leverage internal knowledge of the organization's user population. This reconnaissance step is often a precursor to credential theft and account takeover attempts.

Refer to the Liferay Security Advisory for CVE-2025-43743 for further vendor-published technical details.

Detection Methods for CVE-2025-43743

Indicators of Compromise

• Repeated authenticated requests to calendar-related endpoints (for example, /api/jsonws/calendar or /o/calendar/) from a single session enumerating identifiers
• Unusual volumes of HTTP 200 responses to calendar listing calls originating from low-privilege user accounts
• Follow-on inbound phishing emails referencing internal usernames or role titles harvested from the portal

Detection Strategies

• Baseline normal calendar API usage per user role and alert on sessions that request calendars outside typical patterns
• Correlate authenticated portal activity with subsequent outbound phishing reports involving named internal users
• Review Liferay audit logs for accounts enumerating user or calendar entities in rapid succession

Monitoring Recommendations

• Enable verbose logging on Liferay's calendar and user-search endpoints and forward logs to a centralized SIEM
• Track authentication events for accounts that exhibit reconnaissance behavior against multiple portal resources
• Alert on any single account that retrieves calendar data for a large percentage of the user directory within a short window

How to Mitigate CVE-2025-43743

Immediate Actions Required

• Upgrade Liferay Portal to a version above 7.4.3.132 or apply the patched Liferay DXP release matching your quarterly track
• Audit portal accounts for unnecessary calendar permissions and remove access from accounts that do not require it
• Review recent calendar API access logs to identify potential prior enumeration activity

Patch Information

Liferay has addressed the issue in updated releases across the affected Portal and DXP branches. Consult the Liferay Security Advisory for CVE-2025-43743 for the specific fixed versions and upgrade guidance for your deployment track.

Workarounds

• Restrict calendar visibility settings through Liferay's permissions framework so calendars are not accessible to authenticated users by default
• Disable or limit exposure of the calendar portlet on public-facing portal instances until patches are applied
• Enforce strong authentication and monitor for anomalous session behavior to reduce the risk of enumeration by compromised low-privilege accounts