CVE-2025-3526
1 advisory.
Maven/com.liferay.portal:com.liferay.portal.kernel CVE-2025-3526: high 7.5
Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session
Action: Upgrade com.liferay.portal:com.liferay.portal.kernel to 38.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 38.0.0 | - |
Fixed versions
| 38.0.0 |
Sources
- osv: GHSA-mf3r-6m25-3867
- nvd: CVE-2025-3526
- https://github.com/liferay/liferay-portal/commit/429834b7cf7c131576f196466a386bb6ce764716
- https://github.com/liferay/liferay-portal/commit/b40fe110eb9d264c9c1a79ff77da317bbe6fa528
- https://github.com/liferay/liferay-portal/commit/d9108a12269e6b27689b2fd06f66fb881c8ec894
- https://github.com/liferay/liferay-portal
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3526
CVE-2025-3526 · published · modified · JSON