Description

Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

Remediation

References

CVE-2025-43768

Related Vulnerabilities

MySQL CVE-2018-3061 Vulnerability (CVE-2018-3061)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-7851)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-42112)

Ruby on Rails Inefficient Regular Expression Complexity Vulnerability (CVE-2024-26142)

MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-3313)

Severity

High

Classification

CVE-2025-43768 CWE-201 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities