CVE-2025-43768

EPSS 0.08%

Liferay Portal JSONWS API endpoint shares sensitive information

Published: 8/23/2025Modified: 8/25/2025

Description

Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

Affected packages (1)

Maven/com.liferay.portal:com.liferay.portal.implfrom 0, < 108.1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-43768
PATCHhttps://github.com/liferay/liferay-portal
WEBhttps://github.com/liferay/liferay-portal/commit/efdbdbce73605ecd13b1a5e60f5186cc59f09c16
WEBhttps://liferay.atlassian.net/browse/LPE-18154
WEBhttps://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43768