GitHub Advisoryadvisory · Maven

GHSA-pfxj-gvqg-mj44 Liferay Profile Widget does not prevent vCard extension spoofing

MEDIUM Published 2025-10-07 Modified 2025-12-17 Official page ↗
Aliases
CVE-2025-43824
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-10-07

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0-ga1, < 7.4.3.112-ga112 → fixed in 7.4.3.112-ga112

Description

The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.

Related

Alias · CVE (1)

  • CVE-2025-43824 The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References