What is the CVSS score of CVE-2025-43825?

CVE-2025-43825 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Liferay Portal are affected by CVE-2025-43825?

Organizations using Liferay Portal 7.4.0 should be aware of notable risk from CVE-2025-43825 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-43825?

Within 30 days: Identify affected systems running Liferay Portal 7.4.0 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Liferay Portal CVE-2025-43825

EUVD-2025-32095 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-10-03 security@liferay.com

GHSA-rggc-gf6w-9q73

Information Disclosure Liferay Portal Digital Experience Platform

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 19:29 euvd

EUVD-2025-32095

Analysis Generated

Mar 13, 2026 - 19:29 vuln.today

CVE Published

Oct 03, 2025 - 22:15 nvd

MEDIUM 6.5

DescriptionCVE.org

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.

AnalysisAI

A security vulnerability in Liferay Portal 7.4.0 (CVSS 6.5) that allows sensitive user data. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

CWE-201 (Information Exposure via Sent Data). Affects Liferay Portal 7.4.0.

RemediationAI

Monitor vendor channels for patch availability.

CVE-2025-43825 vulnerability details – vuln.today

Back

Liferay Portal CVE-2025-43825

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code