CVE-2025-2565 — Sensitive Info Insertion into Sent Data in DXP

CWE-201 — Sensitive Info Insertion into Sent Data4 documents4 sources
Severity
5.1MEDIUMNVD
EPSS
0.1%
top 72.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay DXPLiferay PortalLiferay Digital Experience Platform+1 more
Timeline
PublishedMar 20

Description

The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.0 — 7.4.3.128
▶NVDliferay/liferay_portal7.4.0 — 7.4.3.128
▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+5
▶NVDliferay/digital_experience_platform2023.Q3.1 — 2023.Q3.10+5

🔴Vulnerability Details

3
GHSA
Liferay Portal and Liferay DXP Reveals Data via Forms↗2025-03-20
▶
CVEList
CVE-2025-2565: The data exposure vulnerability in Liferay Portal 7↗2025-03-20
▶
OSV
Liferay Portal and Liferay DXP Reveals Data via Forms↗2025-03-20
▶
CVE-2025-2565 — Sensitive Info Insertion into Sent Data | cvebase