What is GHSA-cv9j-mg9w-v7wm?

GHSA-cv9j-mg9w-v7wm is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal JSONWS API endpoint shares sensitive information

Which CVE IDs does GHSA-cv9j-mg9w-v7wm cover?

GHSA-cv9j-mg9w-v7wm covers the following CVE IDs: CVE-2025-43768. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-cv9j-mg9w-v7wm?

GHSA-cv9j-mg9w-v7wm affects 1 product, including: maven/com.liferay.portal:com.liferay.portal.impl:\u003c 108.1.1.

GHSA-cv9j-mg9w-v7wmMedium

Liferay Portal JSONWS API endpoint shares sensitive information

Vendor

GitHub Security Advisories

Published

August 23, 2025

Last Modified

August 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-43768 →

📋 Description

Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.

🎯 Affected products1

maven/com.liferay.portal:com.liferay.portal.impl:< 108.1.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43768
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43768
https://github.com/liferay/liferay-portal/commit/efdbdbce73605ecd13b1a5e60f5186cc59f09c16
https://liferay.atlassian.net/browse/LPE-18154
https://github.com/advisories/GHSA-cv9j-mg9w-v7wm