CVE-2025-62275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62275", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2025-10-09T20:58:54.403Z", "datePublished": "2025-11-01T02:42:50.698Z", "dateUpdated": "2025-11-03T15:47:50.284Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.111", "status": "affected", "version": "7.4.0", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.13-u92", "status": "affected", "version": "7.4.13", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q3.10", "status": "affected", "version": "2023.Q3.1", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q4.10", "status": "affected", "version": "2023.Q4.0", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL."}], "value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-11-01T02:42:50.698Z"}, "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T15:47:43.985392Z", "id": "CVE-2025-62275", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T15:47:50.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62275", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T15:47:43.985392Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T15:47:47.635Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.111"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.4.13", "versionType": "maven", "lessThanOrEqual": "7.4.13-u92"}, {"status": "affected", "version": "2023.Q3.1", "versionType": "maven", "lessThanOrEqual": "2023.Q3.10"}, {"status": "affected", "version": "2023.Q4.0", "versionType": "maven", "lessThanOrEqual": "2023.Q4.10"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.", "supportingMedia": [{"type": "text/html", "value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2025-11-01T02:42:50.698Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62275", "state": "PUBLISHED", "dateUpdated": "2025-11-03T15:47:50.284Z", "dateReserved": "2025-10-09T20:58:54.403Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2025-11-01T02:42:50.698Z", "assignerShortName": "Liferay"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.111", "status": "affected", "version": "7.4.0", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.13-u92", "status": "affected", "version": "7.4.13", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q3.10", "status": "affected", "version": "2023.Q3.1", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q4.10", "status": "affected", "version": "2023.Q4.0", "versionType": "maven"}]}], "source": "security@liferay.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:*", "matchCriteriaId": "8E19E344-92B4-4B46-BD89-25EC7191972C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*", "matchCriteriaId": "1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*", "matchCriteriaId": "9D6CE430-3C95-4855-BA44-E2E136D1FEB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*", "matchCriteriaId": "44FEB149-C792-493D-B055-568FFC96298A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*", "matchCriteriaId": "B050DD73-71B6-46CD-A35B-7ACB53BE6C6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5:*:*:*:*:*:*:*", "matchCriteriaId": "62432289-E1DC-4013-85C7-6B77299A910F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.6:*:*:*:*:*:*:*", "matchCriteriaId": "0912EEFE-DC56-43F6-AE0E-A4E2A033F3C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.7:*:*:*:*:*:*:*", "matchCriteriaId": "9398F679-5F47-4DF2-AA91-4A21126675C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.8:*:*:*:*:*:*:*", "matchCriteriaId": "8296B54A-976A-404C-AB77-0619E4297A69", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.9:*:*:*:*:*:*:*", "matchCriteriaId": "F778EB15-2AB0-44C1-BD99-9F7F1851E167", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.10:*:*:*:*:*:*:*", "matchCriteriaId": "625E6C10-D0C7-4C5D-99F8-601A7B942392", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:*", "matchCriteriaId": "B5CE3202-2723-44A6-B63F-061138287FDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1:*:*:*:*:*:*:*", "matchCriteriaId": "A27A8480-7EE1-4265-9117-D6C234ACAC5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2:*:*:*:*:*:*:*", "matchCriteriaId": "94425688-725E-41DC-B2D3-14F2A7163AD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.3:*:*:*:*:*:*:*", "matchCriteriaId": "623CA096-BDBB-4F59-B734-07FB405800CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.4:*:*:*:*:*:*:*", "matchCriteriaId": "30B27CBE-14BA-4EBB-8B74-91DD1228A1F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.5:*:*:*:*:*:*:*", "matchCriteriaId": "81EDBB1C-9EBB-4FAD-ADAC-B5A890BB3F50", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.6:*:*:*:*:*:*:*", "matchCriteriaId": "658B4C0D-D8A2-40DF-87BE-A2E148082BB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.7:*:*:*:*:*:*:*", "matchCriteriaId": "9C3DD89D-A40C-4C31-B698-A23C4A6F243E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.8:*:*:*:*:*:*:*", "matchCriteriaId": "C785189B-09C0-4395-A8C5-4C548836B08C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.9:*:*:*:*:*:*:*", "matchCriteriaId": "C436962A-5DAC-4843-9EE9-3E18F1524BE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q4.10:*:*:*:*:*:*:*", "matchCriteriaId": "DFCAE569-D95A-4635-8E92-5142A7C70F51", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D6470C7-9D36-43F3-86CB-B79ED9EA53F4", "versionEndExcluding": "7.4.3.112", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions does not check permission of images in a blog entry, which allows remote attackers to view the images in a blog entry via crafted URL."}, {"lang": "es", "value": "Blogs en Liferay Portal 7.4.0 hasta 7.4.3.111, y versiones anteriores no compatibles, y Liferay DXP 2023.Q4.0 hasta 2023.Q4.10, 2023.Q3.1 hasta 2023.Q3.10, 7.4 GA hasta la actualizaci\u00f3n 92, y versiones anteriores no compatibles no verifica el permiso de las im\u00e1genes en una entrada de blog, lo que permite a atacantes remotos ver las im\u00e1genes en una entrada de blog a trav\u00e9s de una URL manipulada."}], "id": "CVE-2025-62275", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@liferay.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62275", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T15:47:43.985392Z", "version": "2.0.3"}}]}, "published": "2025-11-01T03:15:31.757", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62275"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@liferay.com", "type": "Secondary"}]}

{}

{"created": "2025-11-03T10:43:45.359021+00:00", "updated": "2025-11-03T10:43:45.359057+00:00", "vendors": ["liferay", "liferay$PRODUCT$dxp", "liferay$PRODUCT$portal"]}