Skip to content

Commit 0e03b18

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-697h-3q6m-jwp4 GHSA-8c8v-r5jj-4425 GHSA-qx3f-6vq3-8j8m GHSA-qx3f-6vq3-8j8m
1 parent 2aa1335 commit 0e03b18

File tree

4 files changed

+236
-46
lines changed

4 files changed

+236
-46
lines changed

advisories/unreviewed/2025/09/GHSA-697h-3q6m-jwp4/GHSA-697h-3q6m-jwp4.json renamed to advisories/github-reviewed/2025/09/GHSA-697h-3q6m-jwp4/GHSA-697h-3q6m-jwp4.json

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-697h-3q6m-jwp4",
4-
"modified": "2025-09-19T21:31:20Z",
4+
"modified": "2025-09-19T23:04:43Z",
55
"published": "2025-09-19T21:31:20Z",
66
"aliases": [
77
"CVE-2025-43809"
88
],
9+
"summary": "Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability",
910
"details": "Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license via the 'orderUuid' parameter.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay.portal:com.liferay.portal.impl"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "101.0.0"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -29,8 +50,8 @@
2950
"CWE-352"
3051
],
3152
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2025-09-19T23:04:43Z",
3455
"nvd_published_at": "2025-09-19T20:15:39Z"
3556
}
3657
}

advisories/unreviewed/2025/09/GHSA-8c8v-r5jj-4425/GHSA-8c8v-r5jj-4425.json renamed to advisories/github-reviewed/2025/09/GHSA-8c8v-r5jj-4425/GHSA-8c8v-r5jj-4425.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8c8v-r5jj-4425",
4-
"modified": "2025-09-19T21:31:20Z",
4+
"modified": "2025-09-19T23:04:20Z",
55
"published": "2025-09-19T21:31:20Z",
66
"aliases": [
77
"CVE-2025-43803"
88
],
9+
"summary": "Liferay Contacts Center widget has insecure direct object reference",
910
"details": "Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay:com.liferay.contacts.web"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.0.59"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43803"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/liferay/liferay-portal"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43803"
@@ -29,8 +54,8 @@
2954
"CWE-639"
3055
],
3156
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-09-19T23:04:20Z",
3459
"nvd_published_at": "2025-09-19T19:15:41Z"
3560
}
3661
}

‎advisories/github-reviewed/2025/09/GHSA-qx3f-6vq3-8j8m/GHSA-qx3f-6vq3-8j8m.json‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qx3f-6vq3-8j8m",
4+
"modified": "2025-09-19T23:05:10Z",
5+
"published": "2025-09-19T21:31:21Z",
6+
"aliases": [
7+
"CVE-2025-9079"
8+
],
9+
"summary": "Mattermost Path Traversal vulnerability",
10+
"details": "Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upload to prepackaged plugins directory",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "10.8.0"
29+
},
30+
{
31+
"fixed": "10.8.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.5.0"
48+
},
49+
{
50+
"fixed": "10.5.9"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost-server"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "9.11.0"
67+
},
68+
{
69+
"fixed": "9.11.18"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Go",
78+
"name": "github.com/mattermost/mattermost-server"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "10.10.0"
86+
},
87+
{
88+
"fixed": "10.10.2"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Go",
97+
"name": "github.com/mattermost/mattermost-server"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "10.9.0"
105+
},
106+
{
107+
"fixed": "10.9.4"
108+
}
109+
]
110+
}
111+
]
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "Go",
116+
"name": "github.com/mattermost/mattermost/server/v8"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "0"
124+
},
125+
{
126+
"fixed": "8.0.0-20250707221302-a8fa77f107ef"
127+
}
128+
]
129+
}
130+
]
131+
}
132+
],
133+
"references": [
134+
{
135+
"type": "ADVISORY",
136+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9079"
137+
},
138+
{
139+
"type": "WEB",
140+
"url": "https://github.com/mattermost/mattermost/commit/047a2c64071749367fe02d2162f6103a3d31a883"
141+
},
142+
{
143+
"type": "WEB",
144+
"url": "https://github.com/mattermost/mattermost/commit/439464883aa16a329c23cd6274c4cca7e88e238f"
145+
},
146+
{
147+
"type": "WEB",
148+
"url": "https://github.com/mattermost/mattermost/commit/4ff68eea0a3f3777032d31a1a82f4b1fb492a1ac"
149+
},
150+
{
151+
"type": "WEB",
152+
"url": "https://github.com/mattermost/mattermost/commit/96665b9b98a17534fcd515982a2eb26950581e41"
153+
},
154+
{
155+
"type": "WEB",
156+
"url": "https://github.com/mattermost/mattermost/commit/a8fa77f107efe83f09a779f8e67cbecf236b0032"
157+
},
158+
{
159+
"type": "WEB",
160+
"url": "https://github.com/mattermost/mattermost/commit/b38e2eccda182212a8032539658723c7d87e0b7e"
161+
},
162+
{
163+
"type": "PACKAGE",
164+
"url": "https://github.com/mattermost/mattermost"
165+
},
166+
{
167+
"type": "WEB",
168+
"url": "https://mattermost.com/security-updates"
169+
}
170+
],
171+
"database_specific": {
172+
"cwe_ids": [
173+
"CWE-22"
174+
],
175+
"severity": "HIGH",
176+
"github_reviewed": true,
177+
"github_reviewed_at": "2025-09-19T23:05:09Z",
178+
"nvd_published_at": "2025-09-19T20:15:40Z"
179+
}
180+
}

‎advisories/unreviewed/2025/09/GHSA-qx3f-6vq3-8j8m/GHSA-qx3f-6vq3-8j8m.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

0 commit comments

Comments
 (0)