CVE-2025-43751: Liferay DXP User Enumeration Vulnerability

CVE-2025-43751 Overview

CVE-2025-43751 is a user enumeration vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the create account page, where the application returns distinguishable responses that reveal whether a submitted account identifier already exists. Unauthenticated remote attackers can query the endpoint to confirm valid accounts, producing a curated list of users for downstream attacks such as credential stuffing, password spraying, and targeted phishing. The issue is classified under [CWE-203] Observable Discrepancy.

Critical Impact
Unauthenticated remote attackers can enumerate valid user accounts on affected Liferay Portal and DXP deployments, enabling credential-based follow-on attacks.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.132
Liferay DXP 2024.Q1.1 through Q4.7, 2023.Q3.1 through Q4.10
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-08-22 - CVE-2025-43751 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43751

Vulnerability Analysis

The vulnerability is an observable discrepancy in the create account workflow of Liferay Portal and DXP. When a user submits registration data, the application processes the request differently based on whether the supplied identifier (typically an email address or screen name) is already associated with an existing account. The differential response — whether in HTTP status, response body content, error message text, or response timing — allows an unauthenticated attacker to distinguish valid accounts from non-existent ones.

Attackers can automate requests against the create account endpoint using a wordlist of candidate email addresses or usernames. Each response reveals whether the identifier maps to an existing user. This transforms a public registration form into an oracle for account discovery.

While the direct confidentiality impact is limited to account existence, the enumerated list materially reduces the attacker's workload for subsequent credential stuffing, password spraying, and targeted phishing against confirmed accounts.

Root Cause

The root cause is inconsistent handling of duplicate-account conditions on the create account page. Rather than returning a uniform response for both valid and invalid submissions, the application discloses account state through differentiated output. This violates the guidance in [CWE-203] to normalize responses so that they do not leak information about internal state.

Attack Vector

Exploitation requires network access to the Liferay portal's public registration page. No authentication, elevated privileges, or user interaction is needed. An attacker submits crafted account creation requests, iterating over candidate identifiers, and parses each response to classify identifiers as existing or non-existing.

No public exploit code or proof-of-concept has been published for CVE-2025-43751, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Liferay Security Advisory CVE-2025-43751 for vendor details.

Detection Methods for CVE-2025-43751

Indicators of Compromise

High-volume POST requests to the create account endpoint originating from a single source IP or a small IP range within a short interval.
Repeated submissions to registration URLs with sequential or dictionary-based email values and otherwise identical form fields.
Requests to the account creation page followed by no subsequent account activation traffic.

Detection Strategies

Monitor web server and reverse proxy logs for anomalous request rates against the /web/guest/home?p_p_id=com_liferay_login_web_portlet_LoginPortlet and create account URL paths.
Correlate spikes in HTTP 400-class responses from the registration endpoint with distinct source IPs to identify enumeration campaigns.
Alert on user-agent strings and header patterns consistent with scripted automation rather than interactive browser sessions.

Monitoring Recommendations

Ingest Liferay access logs and application logs into a centralized SIEM and baseline normal registration traffic volumes.
Enable rate-limit and CAPTCHA telemetry from any upstream WAF or bot management solution and alert when thresholds are exceeded.
Track failed and duplicate registration attempts per source IP over rolling one-hour and twenty-four-hour windows.

How to Mitigate CVE-2025-43751

Immediate Actions Required

Apply the latest Liferay Portal and DXP security updates referenced in the vendor advisory as soon as change control permits.
Place the create account endpoint behind a WAF policy that enforces rate limiting and blocks known enumeration user-agents.
Require CAPTCHA or equivalent human-verification challenges on the registration form to raise the cost of automated enumeration.

Patch Information

Liferay has published guidance for CVE-2025-43751 in the Liferay Security Advisory CVE-2025-43751. Administrators should upgrade Liferay Portal beyond 7.4.3.132 and Liferay DXP beyond update 92 or the latest available quarterly release for their supported branch.

Workarounds

Configure the registration workflow to return a uniform confirmation response regardless of whether the submitted identifier already exists, deferring notification to an out-of-band email.
Deploy WAF rules that throttle requests to the create account endpoint per source IP and challenge suspected automation.
Restrict access to the registration page to authenticated internal users where public self-registration is not a business requirement.

bash

# Configuration example
# Example NGINX rate limit for the Liferay create account endpoint
limit_req_zone $binary_remote_addr zone=liferay_register:10m rate=5r/m;

location /web/guest/home {
    limit_req zone=liferay_register burst=10 nodelay;
    proxy_pass http://liferay_upstream;
}