6.9

CVE-2025-43798 Time-based One-Time Password (TOTP) reuse

Description

Liferay DXP allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.

Severity

6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)

Affected Version(s)

  • Liferay DXP 2023.Q4.0
  • Liferay DXP 2023.Q3.1 through 2023.Q3.4
  • Liferay DXP 7.4 GA thorugh U92
  • Liferay DXP 7.3 GA thorugh U35

Fixed Version(s)

 

  • Liferay DXP 2024.Q1.1
  • Liferay DXP 2023.Q4.1
  • Liferay DXP 2023.Q3.5
  • Liferay DXP 7.3 U36

Publication Date: 

9月 15, 2025

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Welcome to the new Blogs page, where you can search and filter the available blogs to much more easily find what you're looking for!

But, don't worry - if you prefer the old UX with the Blogs Widget, it's still available - just use the Blogs List link in the left navigation and it will be like it's 1999 all over again!

To add a new blog, use the "New Entry" button here on on the Blogs List page.

To manage Drafts and view unpublished blogs please use the Blogs List page.