PT-2025-33670 · Liferay · Liferay Portal+1

Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-3639

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.0 through 7.4.3.132 Liferay DXP versions 2025.Q1 through 2025.Q1.6 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.15 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 36

Description: The application allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET when multi-factor authentication (MFA) is enabled.

Recommendations: Liferay Portal versions 7.3.0 through 7.3 GA update 36: Update to a newer version. Liferay Portal versions 7.4 GA through 7.4.3.132: Update to a newer version. Liferay DXP versions 2024.Q1.1 through 2024.Q1.15: Update to a newer version. Liferay DXP versions 2024.Q2.0 through 2024.Q2.13: Update to a newer version. Liferay DXP versions 2024.Q3.1 through 2024.Q3.13: Update to a newer version. Liferay DXP versions 2024.Q4.0 through 2024.Q4.7: Update to a newer version. Liferay DXP versions 2025.Q1 through 2025.Q1.6: Update to a newer version.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-3639

GHSA-G4WG-MPFG-X2Q6

Affected Products

Liferay Dxp

Liferay Portal

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-3639 · Security Note
• https://osv.dev/vulnerability/GHSA-g4wg-mpfg-x2q6 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/7a70daf60416d536a45fe137d54e1054e9394fa7 · Note
• https://github.com/liferay/liferay-portal/commit/e4bb21b85440157b588ebbd217995113362962cc · Note
• https://github.com/liferay/liferay-portal/commit/e67b47a47f3bccc9a85aeee6a40cd0188787aa0f · Note
• https://github.com/liferay/liferay-portal/commit/a5081fefaffdd86a9306320c46e91f98973c39cb · Note
• https://github.com/liferay/liferay-portal/commit/d2806ad26cb194d0c7d654f9c447857e05dd44b2 · Note
• https://github.com/liferay/liferay-portal/commit/a0265c3847af01a37d2a9ad1560e4408f2856518 · Note
• https://github.com/liferay/liferay-portal/commit/774c89c853d4b9d9abb61d6e079dab21f582cc78 · Note
• https://github.com/liferay/liferay-portal/commit/eb0457503fdb8ac49c662b690a6a4eb139ee4c67 · Note
• https://github.com/liferay/liferay-portal/commit/383a4001cfdf533eb077ed6f03bc5f8fed27cf05 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3639 · Note
• https://twitter.com/CVEnew/status/1957491810743341566 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957516115564765667 · Twitter Post