CVE-2025-43772

State: Published
Severity: 7.1 High
Published: Sep 4, 2025
Updated: Sep 4, 2025
Reserved: Apr 17, 2025

Description

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	Liferay

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
PortalLiferay	7.0.0 through 7.4.3.5Affected
DXPLiferay	6.2.0 through portal-173Affected 7.0.10 through de-102Affected 7.1.10 through dxp-28Affected 7.2.10 through dxp-20Affected 7.3.10 through 7.3.10-u27Affected 7.4.13 through 7.4.13-u1Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43772

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.