GHSA-fvp7-jj9m-3qpf

Source

https://github.com/advisories/GHSA-fvp7-jj9m-3qpf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-fvp7-jj9m-3qpf/GHSA-fvp7-jj9m-3qpf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fvp7-jj9m-3qpf

Aliases

CVE-2025-43784

Published

2025-09-10T21:30:19Z

Modified

2025-12-20T03:05:20Z

Severity

6.2 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

Details

An Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-12T21:08:53Z",
    "nvd_published_at":  "2025-09-10T19:15:41Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / com.liferay:com.liferay.headless.builder.impl

Package

Name: com.liferay:com.liferay.headless.builder.impl; View open source insights on deps.dev
Purl: pkg:maven/com.liferay/com.liferay.headless.builder.impl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.32

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

1.0.23

1.0.24

1.0.25

1.0.26

1.0.27

1.0.28

1.0.29

1.0.30

1.0.31

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-fvp7-jj9m-3qpf/GHSA-fvp7-jj9m-3qpf.json"