← Back

CVE-2025-43825

nvd nist
Published: Oct 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.6
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@liferay.com (Secondary)

Description

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.

Affected (9)

Liferay
2 products
Digital Experience Platform
Liferay Portal
Configuration A
9 vulnerable
Vulnerable SoftwareAffected Versions
Liferay
Digital Experience Platform
From 2023.Q3.1 to 2023.Q3.10
Digital Experience Platform
From 2023.q4.0 to 2023.q4.10
Digital Experience Platform
From 2024.Q1.1 to 2024.Q1.13
Digital Experience Platform
From 2024.Q2.1 to 2024.Q2.13
Digital Experience Platform
From 2024.Q3.0 to 2024.Q3.13
Digital Experience Platform
From 2024.Q4.0 to 2024.Q4.6
Digital Experience Platform
From 2025.Q1.1 to 2025.Q1.4
Digital Experience Platform
Version 7.4
Liferay Portal
From 7.4.0 to 7.4.3.132

Related CWEs

CWE-201
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (1)

Source: security@liferay.com
Vendor Advisory

Timeline

No history available yet.