{"action":"Upgrade com.liferay:com.liferay.comment.web to 6.1.4 or later.","affected":[{"fixed":"6.1.4","introduced":"6.0.2"}],"component":"com.liferay:com.liferay.comment.web","cve_ids":["CVE-2025-43789"],"ecosystem":"Maven","epss":0.00216,"exploited":false,"fixed_versions":["6.1.4"],"ghsa_id":"GHSA-q86r-gwqc-jx85","id":"tcs_01M5N991TD6VMRVM7XYSCJSK59","modified_at":"2025-09-15T13:59:44.861068Z","published_at":"2025-09-12T03:33:06Z","references":["https://osv.dev/vulnerability/GHSA-q86r-gwqc-jx85","https://nvd.nist.gov/vuln/detail/CVE-2025-43789","https://github.com/liferay/liferay-portal/commit/576039619a12f28304c5153ad3fa5e39f00548b3","https://github.com/liferay/liferay-portal/commit/cb349be999396e97883e5fa7ccf2d226737779ac","https://github.com/liferay/liferay-portal/commit/dfdd81d51808e38098e9a3250f3c8819e0761377","https://github.com/liferay/liferay-portal/commit/e91daba3736ea30674f0beb5f6622c6df057d18b","https://github.com/liferay/liferay-portal","https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43789"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-q86r-gwqc-jx85","url":"https://osv.dev/vulnerability/GHSA-q86r-gwqc-jx85"},{"source":"nvd","source_id":"CVE-2025-43789","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43789"}],"summary":"Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution"}