GitHub Advisoryadvisory · Maven

GHSA-9fcg-wrp8-qhr4 Liferay Portal and Liferay DXP Reveals Data via Forms

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2025-2565
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-201
Reviewed
2025-03-21

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0, < 7.4.3.129 → fixed in 7.4.3.129 • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q3.0, < 2024.Q3.1 → fixed in 2024.Q3.1 • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q2.0, <= 2024.Q2.12 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2024.Q1.1, < 2024.Q1.13 → fixed in 2024.Q1.13 • Maven com.liferay.portal:release.dxp.bom: >= 2023.Q4.0, <= 2023.Q4.10 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: >= 2023.Q3.1, <= 2023.Q3.10 (no fix yet)

Description

The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.

Related

Alias · CVE (1)

  • CVE-2025-2565 The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12,… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References