CVE-2025-43772: Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request…

High severity · published Sep 4, 2025

CVE-2025-43772

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request…

7.1

CVSS

0.5%

EPSS

On KEV

Description

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 44% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DXP · Liferay

6.2.0 through portal-173; 7.0.10 through de-102; 7.1.10 through dxp-28; 7.2.10 through dxp-20; 7.3.10 through 7.3.10-u27; 7.4.13 through 7.4.13-u1 · source: vendor

Portal · Liferay

7.0.0 through 7.4.3.5 · source: vendor

Affected product

DXP

Liferay

All DXP CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-43772

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-43772

liferay.dev

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43772