GitHub Advisoryadvisory · Maven

GHSA-cv9j-mg9w-v7wm Liferay Portal JSONWS API endpoint shares sensitive information

MEDIUM Published 2025-08-23 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43768
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-201
Reviewed
2025-08-25

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 108.1.1 → fixed in 108.1.1

Description

Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

Related

Alias · CVE (1)

  • CVE-2025-43768 Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References