PT-2025-42902 · Liferay · Liferay Portal+1

Publicado 2025-10-21 · Atualizado 2025-10-21 · CVE-2025-62250

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal 7.4 GA through update 92

Description An improper authentication issue exists in Liferay Portal and Liferay DXP. Remote attackers can send malicious data to the system that will be treated as trusted data via unauthenticated cluster messages.

Recommendations Liferay Portal versions 7.3 GA through update 35 should be updated. Liferay Portal versions 7.4.0 through 7.4.3.132 should be updated. Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 should be updated. Liferay DXP version 2023.Q4.0 should be updated. Liferay Portal 7.4 GA through update 92 should be updated.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2025-62250

GHSA-6PGJ-W687-9C8C

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 7

• https://github.com/liferay/liferay-portal · Nota
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62250 · Aviso do Fabricante
• https://liferay.atlassian.net/browse/LPE-17901 · Nota
• https://osv.dev/vulnerability/CVE-2025-62250 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-62250 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6pgj-w687-9c8c · Aviso do Fabricante
• https://t.me/CVEtracker/35416 · Publicação no Telegram