CVE-2025-62250

Published Oct 21, 2025 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-6pgj-w687-9c8c Liferay Portal fails to verify messages from the cluster network is trusted
History
Type Values Removed Values Added
First Time appeared Liferay digital Experience Platform
Liferay liferay Portal
CPEs cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Vendors & Products Liferay digital Experience Platform
Liferay liferay Portal
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Type Values Removed Values Added
First Time appeared Liferay
Liferay dxp
Liferay portal
Vendors & Products Liferay
Liferay dxp
Liferay portal
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.
Weaknesses CWE-346
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Liferay
Published
Updated
Oct 21, 2025, 4:06 PM
Reserved
Oct 9, 2025, 8:58 PM
Status
Analyzed
Published
Oct 21, 2025, 4:15 PM
Modified
Oct 18, 2026, 9:10 PM