Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP Insecure Direct Object Reference Vulnerability in Commerce Order Notes

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Liferay Portal versions 7.3.5 through 7.4.3.112, as well as in Liferay DXP versions 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. This vulnerability allows remote authenticated users to add notes to commerce orders across different virtual instances by exploiting the 'commerceOrderId' parameter in the Commerce Order Portlet.

Impact

Exploitation of this vulnerability allows for unauthorized manipulation of order notes across virtual instances, potentially leading to misinformation or mismanagement of order details.

Remediation

Users can upgrade to Liferay Portal 7.4.3.113 or Liferay DXP versions 2024.Q2.0, 2024.Q1.1, or 2023.Q4.9 to address this vulnerability.

Added: Sep 23, 2025, 12:43 AM
Updated: Sep 23, 2025, 12:43 AM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.6
exploitability
4.8
remediation
7.7
relevance
0.5
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.