CVE-2025-2565
Liferay Portal and Liferay DXP Reveals Data via Forms
EPSS 0.36%
Description
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.
How to fix CVE-2025-2565
To remediate CVE-2025-2565, upgrade the affected package to a fixed version below.
- Maven/com.liferay.portal:release.dxp.bom—upgrade to 2024.Q3.1 or later
- Maven/com.liferay.portal:release.portal.bom—upgrade to 7.4.3.129 or later
Is CVE-2025-2565 being exploited?
Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 2024.Q3.0, < 2024.Q3.1
- >= 7.4.0, < 7.4.3.129
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |