CVE-2025-2565

Summary

The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.

Affected Software

VendorProductVersion RangeStatus
LiferayPortal7.4.0 <= 7.4.3.128affected
LiferayDXP7.4.13 <= 7.4.13-u92affected
LiferayDXP2023.Q3.1 <= 2023.Q3.10affected
LiferayDXP2023.Q4.0 <= 2023.Q4.10affected
LiferayDXP2024.Q1.1 <= 2024.Q1.12affected
LiferayDXP2024.Q2.0 <= 2024.Q2.12affected
LiferayDXP2024.Q3.0affected

Weaknesses

  • CWE-201: CWE-201 Insertion of Sensitive Information Into Sent Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References