GitHub Advisoryadvisory · Maven

GHSA-9vwq-j6gq-w9xh Liferay Portal exposes 500 status when attempting login with a deleted client secret

MEDIUM Published 2025-09-09 Modified 2025-09-10 Official page ↗
Aliases
CVE-2025-43777
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.security.sso.openid.connect.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-209
Reviewed
2025-09-10

Affected packages

• Maven com.liferay:com.liferay.portal.security.sso.openid.connect.impl: >= 6.0.4, < 7.0.48 → fixed in 7.0.48

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

Related

Alias · CVE (1)

  • CVE-2025-43777 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References