CVE Intelligence

Vulnerabilidades do Maven Com.liferay.commerce:com.liferay.commerce.product.type.virtual.service

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Maven Com.liferay.commerce:com.liferay.commerce.product.type.virtual.service: 1 registro(s), com versões afetadas e correções.

CVE-2025-43808 Média · 5.3 CWE-732 19/09/2025
Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 service pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.