5.1

CVE-2025-2565

The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorLiferay
≫
Product Portal
Default Statusunaffected
Version <= 7.4.3.128
Version 7.4.0
Status affected
VendorLiferay
≫
Product DXP
Default Statusunaffected
Version <= 7.4.13-u92
Version 7.4.13
Status affected
Version <= 2023.Q3.10
Version 2023.Q3.1
Status affected
Version <= 2023.Q4.10
Version 2023.Q4.0
Status affected
Version <= 2024.Q1.12
Version 2024.Q1.1
Status affected
Version <= 2024.Q2.12
Version 2024.Q2.0
Status affected
Version 2024.Q3.0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.26
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security@liferay.com 5.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.