CVE-2025-43825
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Portal
- Vendor
- Liferay
- Product
- Portal
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 7.4.0 | affected | maven | Unavailable | 7.4.3.132 | None listed |
DXP
- Vendor
- Liferay
- Product
- DXP
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2023.Q3.1 | affected | maven | Unavailable | 2023.Q3.10 | None listed |
| 2023.Q4.0 | affected | maven | Unavailable | 2024.Q4.10 | None listed |
| 2024.Q1.1 | affected | maven | Unavailable | 2024.Q1.12 | None listed |
| 2024.Q2.1 | affected | maven | Unavailable | 2024.Q2.13 | None listed |
| 2024.Q3.0 | affected | maven | Unavailable | 2024.Q3.13 | None listed |
| 2024.Q4.0 | affected | maven | Unavailable | 2024.Q4.5 | None listed |
| 2025.Q1.0 | affected | maven | Unavailable | 2025.Q1.4 | None listed |