What is the CVSS score of CVE-2025-43825?

CVE-2025-43825 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Digital Experience Platform are affected by CVE-2025-43825?

Organizations using Liferay Portal 7.4.0 should be aware of notable risk from CVE-2025-43825 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-43825?

Within 30 days: Identify affected systems running Liferay Portal 7.4.0 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Digital Experience Platform CVE-2025-43825

EUVD-2025-32095 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-10-03 security@liferay.com

GHSA-rggc-gf6w-9q73

Information Disclosure Digital Experience Platform Liferay Portal Liferay

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 19:29 euvd

EUVD-2025-32095

Analysis Generated

Mar 13, 2026 - 19:29 vuln.today

CVE Published

Oct 03, 2025 - 22:15 nvd

MEDIUM 6.5

DescriptionCVE.org

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.

AnalysisAI

A security vulnerability in Liferay Portal 7.4.0 (CVSS 6.5) that allows sensitive user data. Remediation should follow standard vulnerability management procedures.