Can you explain this vulnerability to me?

CVE-2025-43793 is a vulnerability in Liferay Portal and Liferay DXP where the software incorrectly identifies the subdomain of a domain name, causing it to create a supercookie. This flaw allows remote attackers who control a website sharing the same top-level domain (TLD) to read cookies set by the affected application, potentially compromising user data. [1]

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can impact you by allowing remote attackers who control a website under the same top-level domain to read cookies set by your Liferay application. This can lead to unauthorized access to sensitive user data stored in cookies, compromising confidentiality and potentially leading to further attacks or data breaches. [1]

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, immediately upgrade affected Liferay Portal and Liferay DXP installations to the fixed versions: Liferay Portal 7.4.3.106 or later, Liferay DXP 2024.Q1.1, 2023.Q4.1, 2023.Q3.5, or 7.3 U36 or later. Applying these updates will prevent the incorrect subdomain identification and supercookie creation that allows remote attackers to read cookies. Additionally, consider monitoring and restricting access to websites sharing the same top-level domain (TLD) to reduce exposure. [1]

Useful 0 Not Useful 0