CVSS 4.0
2.1 lowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2025-43798
Low (2.1) in liferay digital experience platform. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web 2.0.25.
Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWE
- CWE-304
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4p5r-3jmm-652q | Maven | com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web | <2.0.25 | 2.0.25 |