5.1
CVE-2025-43768
- EPSS 0.04%
- Published 23.08.2025 03:04:06
- Last modified 25.08.2025 20:24:45
- Source security@liferay.com
- Teams watchlist Login
- Open Login
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorLiferay
≫
Product
Portal
Default Statusunaffected
Version <=
7.4.3.131
Version
7.4.0
Status
affected
VendorLiferay
≫
Product
DXP
Default Statusunaffected
Version <=
7.4.13-u92
Version
7.4.13
Status
affected
Version <=
2024.Q1.15
Version
2024.Q1.1
Status
affected
Version <=
2024.Q2.13
Version
2024.Q2.0
Status
affected
Version <=
2024.Q3.13
Version
2024.Q3.1
Status
affected
Version <=
2024.Q4.7
Version
2024.Q4.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.129 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| security@liferay.com | 5.1 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-201 Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.