CVE-2025-43773
📋 TL;DR
This vulnerability in Liferay Portal and DXP allows improper access through the expandoTableLocalService, potentially enabling unauthorized data access or manipulation. It affects Liferay Portal 7.4.0-7.4.3.132 and multiple DXP versions from 7.4 GA through 2025.Q2.0. Organizations running these versions are at risk.
💻 Affected Systems
- Liferay Portal
- Liferay DXP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing unauthorized access to sensitive data, privilege escalation, or remote code execution.
Likely Case
Unauthorized data access or manipulation through the vulnerable service, potentially exposing sensitive information.
If Mitigated
Limited impact if proper access controls and network segmentation are implemented, though vulnerability remains.
🎯 Exploit Status
Exploitation requires access to the expandoTableLocalService interface, which may require some authentication level.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Liferay Portal 7.4.3.133+, Liferay DXP 2025.Q2.1+, 2025.Q1.15+, 2024.Q4.8+, 2024.Q3.14+, 2024.Q2.14+, 2024.Q1.19+, 7.4 update 93+
Vendor Advisory: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43773
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Liferay's customer portal. 2. Apply the patch following Liferay's patch installation guide. 3. Restart the Liferay instance. 4. Verify the patch was applied successfully.
🔧 Temporary Workarounds
Restrict access to expandoTableLocalService
allImplement access controls to limit who can access the vulnerable service interface.
Network segmentation
allIsolate Liferay instances from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for suspicious activity targeting the expandoTableLocalService
🔍 How to Verify
Check if Vulnerable:
Check Liferay version in Control Panel → Configuration → Server Administration → System InformationCheck Version:
Check Liferay build number in Control Panel or via server logsVerify Fix Applied:
Verify version is updated to patched version and check for absence of vulnerability indicators in logs📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to expandoTableLocalService
- Unauthorized data access attempts
- Privilege escalation attempts
Network Indicators:
- Unusual API calls to expando-related endpoints
- Suspicious data exfiltration patterns
SIEM Query:
source="liferay" AND (expandoTableLocalService OR CVE-2025-43773)