CVE-2025-43777
Full vulnerability record from the local CVENow database.
Description
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-09-09 03:15:32.800000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-43777",
"sourceIdentifier": "[email protected]",
"published": "2025-09-09T03:15:32.800",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes \"Internal Server Error\" in the response body when a login attempt is made with a deleted Client Secret."
},
{
"lang": "es",
"value": "Liferay Portal 7.4.0 hasta 7.4.3.132, y Liferay DXP 2025.Q2.0 hasta 2025.Q2.9, 2025.Q1.0 hasta 2025.Q1.16, 2024.Q4.0 hasta 2024.Q4.7, 2024.Q3.0 hasta 2024.Q3.13, 2024.Q2.0 hasta 2024.Q2.13 y 2024.Q1.1 hasta 2024.Q1.19 expone 'Error interno del servidor' en el cuerpo de la respuesta cuando se realiza un intento de inicio de sesión con un Secreto de Cliente eliminado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Liferay",
"product": "Portal",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.4.0",
"lessThanOrEqual": "7.4.3.132",
"versionType": "maven",
"status": "affected"
}
]
},
{
"vendor": "Liferay",
"product": "DXP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2024.Q1.1",
"lessThanOrEqual": "2024.Q1.19",
"versionType": "maven",
"status": "affected"
},
{
"version": "2024.Q2.0",
"lessThanOrEqual": "2024.Q2.13",
"versionType": "maven",
"status": "affected"
},
{
"version": "2024.Q3.0",
"lessThanOrEqual": "2024.Q3.13",
"versionType": "maven",
"status": "affected"
},
{
"version": "2024.Q4.0",
"lessThanOrEqual": "2024.Q4.7",
"versionType": "maven",
"status": "affected"
},
{
"version": "2025.Q1.0",
"lessThanOrEqual": "2025.Q1.16",
"versionType": "maven",
"status": "affected"
},
{
"version": "2025.Q2.0",
"lessThanOrEqual": "2025.Q2.9",
"versionType": "maven",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-09T13:24:07.180108Z",
"id": "CVE-2025-43777",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-209"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.q1.1",
"versionEndExcluding": "2024.q1.20",
"matchCriteriaId": "A7CD6797-2A1B-4621-98A0-07A2F03ED4EB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.q2.0",
"versionEndIncluding": "2024.q2.13",
"matchCriteriaId": "0EB4ABE4-0B4D-471C-A868-0CA6F5EE7A47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.Q3.0",
"versionEndIncluding": "2024.Q3.13",
"matchCriteriaId": "95ED07C5-CA08-40D5-945B-564760714E4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2024.q4.0",
"versionEndIncluding": "2024.q4.7",
"matchCriteriaId": "FB83F0DC-CD4C-4C2F-AEB5-98ABB73428A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.Q1.0",
"versionEndExcluding": "2025.Q1.17",
"matchCriteriaId": "2DD8C36D-4E9D-4234-9F86-AACF68E2D73F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2025.Q2.0",
"versionEndExcluding": "2025.Q2.10",
"matchCriteriaId": "5D9003BB-F786-44FF-8B8C-DC5A9F9E8A13"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.4.0",
"versionEndIncluding": "7.4.3.132",
"matchCriteriaId": "8FA15ADB-E7D6-4F24-9A06-F281746CBF06"
}
]
}
]
}
],
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43777",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}