CVE-2025-43819 describes an Insufficient Session Expiration vulnerability affecting Liferay Portal versions 7.4.3.121 through 7.3.3.131 and various Liferay DXP 2024.Q versions. This flaw allows a remote, unauthenticated attacker to reuse old user sessions via the SLO API. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring no user interaction, and potentially leading to low impact on confidentiality and integrity. Its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has garnered no community discussion or media coverage, aligning with the typical lack of attention for most CVEs.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2024.Q1.1, < 2024.Q1.13CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.q2.0, <= 2024.q2.13CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.q3.1, <= 2024.q3.13CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
>= 2024.Q4.0, < 2024.Q4.4CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* | ||
7.4CPE matchmatch criteria | cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.