CVE-2025-2565
First published: Thu Mar 20 2025(Updated: )
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.
Credit: security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay 7.4 GA | >=7.4.0<=7.4.3.126>=7.4<=7.4 GA | |
| Liferay 7.4 GA | >=2024.Q2.0<=2024.Q2.12>=2024.Q1.1<=2024.Q1.12>=2023.Q4.0<=2023.Q4.10>=2023.Q3.1<=2023.Q3.10 | |
| maven/com.liferay.portal:release.dxp.bom | >=2023.Q3.1<=2023.Q3.10 | |
| maven/com.liferay.portal:release.dxp.bom | >=2023.Q4.0<=2023.Q4.10 | |
| maven/com.liferay.portal:release.dxp.bom | >=2024.Q1.1<2024.Q1.13 | 2024.Q1.13 |
| maven/com.liferay.portal:release.dxp.bom | >=2024.Q2.0<=2024.Q2.12 | |
| maven/com.liferay.portal:release.dxp.bom | >=2024.Q3.0<2024.Q3.1 | 2024.Q3.1 |
| maven/com.liferay.portal:release.portal.bom | >=7.4.0<7.4.3.129 | 7.4.3.129 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2565?
CVE-2025-2565 is considered a data exposure vulnerability that allows unauthorized users to access sensitive entry data.
How do I fix CVE-2025-2565?
To fix CVE-2025-2565, update your Liferay Portal to version 7.4.3.127 or later, and Liferay DXP to the latest secure versions.
Which versions of Liferay are affected by CVE-2025-2565?
CVE-2025-2565 affects Liferay Portal versions 7.4.0 through 7.4.3.126 and specific versions of Liferay DXP from 2023.Q3.1 to 2024.Q2.12.
What types of data are exposed in CVE-2025-2565?
CVE-2025-2565 allows unauthorized access to entry data, which may include sensitive user input.
Is there a known exploit for CVE-2025-2565?
As of now, there is no public knowledge of active exploits for CVE-2025-2565, but it is recommended to apply the patch immediately.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9fcg-wrp8-qhr4
- alias/CVE-2025-2565
- collector/nvd-cve
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/github-advisory
- vendor/liferay
- canonical/liferay 7.4 ga
- package-manager/maven