PT-2025-12357 · Liferay · Liferay Portal+1

Published 2025-03-20 · Updated 2025-12-16 · CVE-2025-2565

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.126 Liferay DXP versions 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92

Description The issue allows an unauthorized user to obtain entry data from forms.

Recommendations For Liferay Portal versions 7.4.0 through 7.4.3.126, update to a version outside of this range to resolve the issue. For Liferay DXP versions 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, update to a version outside of these ranges to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-2565

GHSA-9FCG-WRP8-QHR4

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/CVE-2025-2565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2565 · Security Note
• https://osv.dev/vulnerability/GHSA-9fcg-wrp8-qhr4 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvetracker/19562 · Telegram Post
• https://twitter.com/CVEnew/status/1902855220889084393 · Twitter Post
• https://t.me/cvedetector/20747 · Telegram Post
• https://t.me/cveNotify/145990 · Telegram Post