Skip to content

Commit 035dff3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-876g-49r6-33qj GHSA-g5qg-72qw-gw5v GHSA-876g-49r6-33qj
1 parent 827311a commit 035dff3

File tree

3 files changed

+176
-36
lines changed

3 files changed

+176
-36
lines changed

‎advisories/github-reviewed/2025/08/GHSA-876g-49r6-33qj/GHSA-876g-49r6-33qj.json

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-876g-49r6-33qj",
4+
"modified": "2025-08-29T22:07:28Z",
5+
"published": "2025-08-29T21:32:02Z",
6+
"aliases": [
7+
"CVE-2025-43773"
8+
],
9+
"summary": "Liferay Portal allows improper access through the expandoTableLocalService",
10+
"details": "Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay:com.liferay.portal.workflow.kaleo.runtime.impl"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.0.93"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43773"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/liferay/liferay-portal/commit/1cbc4b615c270ce986b7fa1835ed196a11ac3234"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/liferay/liferay-portal/commit/58849cc83348af289944c874301e16e039ae4270"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/liferay/liferay-portal/commit/8eacaaa1e3552648a3e4a0975731641087d186af"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/liferay/liferay-portal/commit/9f56b195aec5c1c904242206d61f3fe412701941"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/liferay/liferay-portal/commit/f33cda648a9082567d7de06c27ba9d3583ee8ff5"
62+
},
63+
{
64+
"type": "PACKAGE",
65+
"url": "https://github.com/liferay/liferay-portal"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://liferay.atlassian.net/browse/LPE-18262"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43773"
74+
}
75+
],
76+
"database_specific": {
77+
"cwe_ids": [
78+
"CWE-862"
79+
],
80+
"severity": "MODERATE",
81+
"github_reviewed": true,
82+
"github_reviewed_at": "2025-08-29T22:07:28Z",
83+
"nvd_published_at": "2025-08-29T19:15:37Z"
84+
}
85+
}

‎advisories/github-reviewed/2025/08/GHSA-g5qg-72qw-gw5v/GHSA-g5qg-72qw-gw5v.json

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g5qg-72qw-gw5v",
4+
"modified": "2025-08-29T22:06:22Z",
5+
"published": "2025-08-29T22:06:22Z",
6+
"aliases": [
7+
"CVE-2025-57752"
8+
],
9+
"summary": "Next.js Affected by Cache Key Confusion for Image Optimization API Routes",
10+
"details": "A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as `Cookie` or `Authorization`), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.\n\nAll users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.\n\nMore details at [Vercel Changelog](https://vercel.com/changelog/cve-2025-57752)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "next"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "14.2.31"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "next"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "15.0.0"
48+
},
49+
{
50+
"fixed": "15.4.5"
51+
}
52+
]
53+
}
54+
],
55+
"database_specific": {
56+
"last_known_affected_version_range": "<= 15.4.4"
57+
}
58+
}
59+
],
60+
"references": [
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/vercel/next.js/pull/82114"
68+
},
69+
{
70+
"type": "WEB",
71+
"url": "https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd"
72+
},
73+
{
74+
"type": "PACKAGE",
75+
"url": "https://github.com/vercel/next.js"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://vercel.com/changelog/cve-2025-57752"
80+
}
81+
],
82+
"database_specific": {
83+
"cwe_ids": [
84+
"CWE-524"
85+
],
86+
"severity": "MODERATE",
87+
"github_reviewed": true,
88+
"github_reviewed_at": "2025-08-29T22:06:22Z",
89+
"nvd_published_at": null
90+
}
91+
}

‎advisories/unreviewed/2025/08/GHSA-876g-49r6-33qj/GHSA-876g-49r6-33qj.json

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)