CVE-2025-43777 — Information Exposure via Error Message in Digital Experience Platform

CWE-209 — Information Exposure via Error Message4 documents4 sources
Severity
5.1MEDIUMNVD
EPSS
0.0%
top 88.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay DXPLiferay Portal+1 more
Timeline
PublishedSep 9

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.0 — 7.4.3.132
▶NVDliferay/liferay_portal7.4.0 — 7.4.3.132
▶NVDliferay/digital_experience_platform2024.q1.1 — 2024.q1.20+5
▶CVEListV5liferay/dxp2024.Q1.1 — 2024.Q1.19+5

🔴Vulnerability Details

3
OSV
Liferay Portal exposes 500 status when attempting login with a deleted client secret↗2025-09-09
▶
GHSA
Liferay Portal exposes 500 status when attempting login with a deleted client secret↗2025-09-09
▶
CVEList
CVE-2025-43777: Liferay Portal 7↗2025-09-09
▶
CVE-2025-43777 — Information Exposure via Error Message | cvebase