Liferay Portal/DXP FreeMarker Template insertion of sensitive information into sent data

Summaryinfo

A vulnerability was found in Liferay Portal and DXP and classified as problematic. This affects an unknown part of the component FreeMarker Template. The manipulation results in insertion of sensitive information into sent data. This vulnerability was named CVE-2025-43825. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in Liferay Portal and DXP (the affected version is unknown). Affected is an unknown code of the component FreeMarker Template. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. CWE is classifying the issue as CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. This is going to have an impact on confidentiality. CVE summarizes:

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.

The advisory is shared for download at liferay.dev. This vulnerability is traded as CVE-2025-43825 since 04/17/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/16/2025). The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-32430) and CERT Bund (WID-SEC-2025-2203). Once again VulDB remains the best source for vulnerability data.

Affected

• Liferay Portal
• Liferay DXP

Productinfo

Type

• Enterprise Resource Planning Software

Vendor

• Liferay

Name

• DXP
• Portal

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion