IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-19 19:15

MODIFIED

2025-09-22 21:23

EPSS (Prob. Exploit)

0.28%

Top 80.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-09-20

> DESCRIPTION

Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-8c8v-r5jj-4425 MODERATE

Liferay Contacts Center widget has insecure direct object reference

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.contacts.web

< 5.0.59

Fixed in: 5.0.59

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-8c8v-r5jj-4425

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/09/2025 19:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui