GHSA-j4f7-gj7q-xg9m

Source

https://github.com/advisories/GHSA-j4f7-gj7q-xg9m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-j4f7-gj7q-xg9m/GHSA-j4f7-gj7q-xg9m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j4f7-gj7q-xg9m

Aliases

CVE-2025-62251

Published

2025-10-14T00:31:01Z

Modified

2025-10-16T08:12:47Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Liferay has Incorrect Permission Assignment for Critical Resource

Details

Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.

Database specific

{
    "cwe_ids":  [
        "CWE-732"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-15T19:21:09Z",
    "nvd_published_at":  "2025-10-13T22:15:32Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary

Package

Name: com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary; View open source insights on deps.dev
Purl: pkg:maven/com.liferay/com.liferay.site.navigation.menu.item.asset.vocabulary

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.23

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18

1.0.19

1.0.20

1.0.21

1.0.22

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-j4f7-gj7q-xg9m/GHSA-j4f7-gj7q-xg9m.json"