CVE-2025-43805 Overview
CVE-2025-43805 is a missing authorization vulnerability [CWE-862] in Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows unauthenticated remote attackers to view display page templates by requesting crafted URLs. The application fails to enforce an authorization check when a user attempts to view a display page template.
Affected versions include Liferay Portal 7.3.0 through 7.4.3.111, Liferay DXP 2023.Q4.0, DXP 2023.Q3.1 through 2023.Q3.4, DXP 7.4 GA through update 92, and DXP 7.3 GA through update 35. Successful exploitation exposes template content to unauthorized parties, which can reveal internal page structures and business logic.
Critical Impact
Remote, unauthenticated attackers can view Liferay display page templates via crafted URLs, leaking confidential template content and site structure.
Affected Products
- Liferay Portal 7.3.0 through 7.4.3.111
- Liferay DXP 2023.Q4.0 and 2023.Q3.1 through 2023.Q3.4
- Liferay DXP 7.4 GA through update 92 and DXP 7.3 GA through update 35
Discovery Timeline
- 2025-09-16 - CVE-2025-43805 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43805
Vulnerability Analysis
CVE-2025-43805 is classified as a Missing Authorization vulnerability [CWE-862]. Liferay's display page template rendering path does not verify that the requesting user has permission to view the template. As a result, any network-reachable client can retrieve the template contents by supplying a crafted URL.
Display page templates in Liferay define how content types render on the front end. They frequently reference asset structures, custom fields, and business rules. Disclosing them provides attackers with reconnaissance data useful for pivoting to further attacks against the portal.
The vulnerability requires no authentication, no user interaction, and low attack complexity. Impact is limited to confidentiality of template data. Integrity and availability of the portal are not directly affected.
Root Cause
The root cause is a missing permission check in the code path that serves display page templates. Liferay's authorization framework normally validates that a user holds the appropriate role or permission before returning restricted resources. This check is absent for the template view action, so the server returns template content regardless of the caller's identity.
Attack Vector
Exploitation is performed over the network by sending an HTTP request to a Liferay endpoint that resolves a display page template. Because no credentials are required, the attack can originate from the public internet against any exposed Liferay instance. See the Liferay Security Advisory CVE-2025-43805 for vendor guidance on the affected endpoints.
No public proof-of-concept exploit is currently listed for CVE-2025-43805, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Detection Methods for CVE-2025-43805
Indicators of Compromise
- Anonymous HTTP GET requests to Liferay display page template URLs from unusual source IP addresses or automated user agents.
- Bursts of 200 OK responses to unauthenticated requests targeting /o/ or display page template resource paths.
- Access log entries showing template retrieval without an associated authenticated Liferay session cookie.
Detection Strategies
- Review Liferay access logs for requests to display page template endpoints that lack authentication context.
- Correlate web server logs with Liferay audit logs to identify template views that were not preceded by a permission check event.
- Deploy WAF rules that flag repeated requests to template rendering paths from a single source.
Monitoring Recommendations
- Inventory all internet-facing Liferay Portal and DXP instances and confirm each is running a patched version.
- Alert on spikes in traffic to display page template URLs, particularly from anonymous sessions.
- Feed Liferay application logs into a centralized log platform and retain them for retrospective analysis.
How to Mitigate CVE-2025-43805
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release beyond 7.4.3.111 and Liferay DXP to the vendor-supplied patched update.
- Apply the fix pack referenced in the Liferay Security Advisory CVE-2025-43805 for affected DXP versions.
- Restrict network access to Liferay administrative and template endpoints to trusted networks where feasible.
Patch Information
Liferay has published guidance and fix information in the Liferay Security Advisory CVE-2025-43805. Customers on Liferay DXP subscriptions should apply the corresponding service pack or update that includes the authorization check for display page templates. Liferay Portal Community Edition users must upgrade to a release that includes the fix, since 7.3.0 through 7.4.3.111 are affected.
Workarounds
- If immediate patching is not possible, place Liferay behind a reverse proxy or WAF that requires authentication before requests reach display page template endpoints.
- Review and tighten permissions on sensitive display page templates so any inadvertently disclosed content contains no confidential logic.
- Monitor access logs continuously for unauthenticated template requests until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
