CVE-2025-43754: Release.portal.bom Liferay Portal Username Enumeration Vulnerability Vulnerability
MODERATE
Advisory Identifier:
GHSA-x7p4-v8mj-6fxx
CWE-208
Published
Advisory Summary
CVE-2025-43754 is a MODERATE liferay portal username enumeration vulnerability vulnerability (CWE-208: Observable Timing Discrepancy) affecting Release.portal.bom libraries in the Maven ecosystem. The issue involves liferay portal username enumeration vulnerability. Remediation is available in the latest vendor maintenance releases.
CVE-2025-43754 at a Glance
CVE Identifier
CVE-2025-43754
GHSA Identifier
GHSA-x7p4-v8mj-6fxx
Severity
MODERATE
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-208: Observable Timing Discrepancy
Affected Product
Release.portal.bom
Package Ecosystem
Maven
Published Date
Last Updated
How to Fix CVE-2025-43754
To remediate this vulnerability, upgrade all affected Release.portal.bom dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
com.liferay.portal:release.portal.bom
fixed: Latest secure release
<dependency>
<groupId>com.liferay.portal</groupId>
<artifactId>release.portal.bom</artifactId>
<version>Latest secure release</version>
</dependency>
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=com.liferay.portalHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2025-43754, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=com.liferay.portalAnalyze the terminal output to locate any version of Release.portal.bom in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The mvn dependency:tree -Dincludes=com.liferay.portal command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-208: Observable Timing Discrepancy, where two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In Release.portal.bom, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.
CVE-2025-43754 Affected Release.portal.bom Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
com.liferay.portal:release.portal.bom
|
Maven |
≥ 7.4.0-ga1
≤ 7.4.3.132-ga132
|
|
References
NVD — CVE-2025-43754
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43754
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29
Security Fix Commit
FIX COMMIT
https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d
liferay.atlassian.net/browse/lpe-18149
WEB
https://liferay.atlassian.net/browse/LPE-18149
Release.portal.bom Security Information
SECURITY
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754
Release.portal.bom Source Repository
REPOSITORY
https://github.com/liferay/liferay-portal
Security Fix Commit
FIX COMMIT
http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181
Frequently Asked Questions
What is CVE-2025-43754?
CVE-2025-43754 is a security vulnerability in Release.portal.bom involving Liferay Portal Username Enumeration Vulnerability under CWE-208: Observable Timing Discrepancy.
Which Release.portal.bom versions are affected?
Affected versions include releases prior to current release patches across affected packages: com.liferay.portal:release.portal.bom.
What version fixes CVE-2025-43754?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is release.portal.bom affected?
Yes, com.liferay.portal:release.portal.bom is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with CVE-2025-43754?
CVE-2025-43754 is classified under CWE-208: Observable Timing Discrepancy (Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.).
How can I check Maven dependencies for CVE-2025-43754?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=com.liferay.portal'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-x7p4-v8mj-6fxx",
"modified" : "2025-08-22T16:51:24Z",
"published" : "2025-08-21T18:31:29Z",
"aliases" : [ "CVE-2025-43754" ],
"summary" : "Liferay Portal Username Enumeration Vulnerability",
"details" : "Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "com.liferay.portal:release.portal.bom"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.4.0-ga1"
}, {
"last_affected" : "7.4.3.132-ga132"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-43754"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/f25bb9583f059f86937649fdacf940928ca3767b"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/c8041d0f527388305897ac79f98d012bb31b82ac"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/9ce8b8dec237f9b9049760904fcefd06a8695832"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/9b4be82e964e9bbab1ce9824a61d9f40b28f38bb"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/862ca74aaf98c70823022b6556cdc8a339128f79"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/7118e956516d48792fb9365d1ae1f0ee971a8ac3"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/6fdbb052a6e0cbe8b300138fb75f88df69f58799"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/6f6f9f0922f6a13e21236915b864e0c1c12e47a9"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/6629bb176c1f58ca852d599c013bd3e97b3312d3"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/5b1bf48b0dc2a062928237ab1ea4a2274c63e652"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/556450752159503476635c44736721ad797fa431"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/53e6dcaa31a7599df8de9d3cef92e59e95a2064e"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/45c3ca76966ddfaf8fe650f28910b0f55536f2b4"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/38c0a06cebf0d635aa2af9912c068217161fcf1e"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/367dc7d19aa31eaf881f217ceff9610f1747e2d7"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/33697cf599a2c573ef9571696af55476ecc2ada6"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/18a88af5409a5085cb094f5bc55229d5e03a9f29"
}, {
"type" : "WEB",
"url" : "https://github.com/liferay/liferay-portal/commit/06b603671f0e76cd50f56d803a310a3c79944d1d"
}, {
"type" : "WEB",
"url" : "https://liferay.atlassian.net/browse/LPE-18149"
}, {
"type" : "WEB",
"url" : "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/liferay/liferay-portal"
}, {
"type" : "WEB",
"url" : "http://github.com/liferay/liferay-portal/commit/8199c568a66d66d6ad7ac450d3c69f6e0e9bd181"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-208" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-08-22T16:51:24Z",
"nvd_published_at" : "2025-08-21T18:15:33Z"
}
}