GHSA-rggc-gf6w-9q73

Source

https://github.com/advisories/GHSA-rggc-gf6w-9q73

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-rggc-gf6w-9q73/GHSA-rggc-gf6w-9q73.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rggc-gf6w-9q73

Aliases

CVE-2025-43825

Published

2025-10-04T00:32:21Z

Modified

2025-12-17T00:45:02Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Liferay Portal exposes sensitive user data through its Freemarker template

Details

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially expose, confidential information that should remain restricted.

Database specific

{
    "cwe_ids":  [
        "CWE-201"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-07T12:59:19Z",
    "nvd_published_at":  "2025-10-03T22:15:30Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / com.liferay:com.liferay.portal.template.freemarker

Package

Name: com.liferay:com.liferay.portal.template.freemarker; View open source insights on deps.dev
Purl: pkg:maven/com.liferay/com.liferay.portal.template.freemarker

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.3

Fixed

7.0.60

Affected versions

7.*

7.0.3

7.0.4

7.0.5

7.0.6

7.0.7

7.0.8

7.0.9

7.0.10

7.0.11

7.0.12

7.0.13

7.0.14

7.0.15

7.0.16

7.0.17

7.0.18

7.0.19

7.0.20

7.0.21

7.0.22

7.0.23

7.0.24

7.0.25

7.0.26

7.0.27

7.0.28

7.0.29

7.0.30

7.0.31

7.0.32

7.0.33

7.0.34

7.0.35

7.0.36

7.0.37

7.0.38

7.0.39

7.0.40

7.0.41

7.0.42

7.0.43

7.0.44

7.0.45

7.0.46

7.0.47

7.0.48

7.0.49

7.0.50

7.0.51

7.0.52

7.0.53

7.0.54

7.0.55

7.0.56

7.0.57

7.0.58

7.0.59

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-rggc-gf6w-9q73/GHSA-rggc-gf6w-9q73.json"