PT-2025-41802 · Liferay · Liferay Dxp

Foobar7 · CVE-2025-62241 · Published 2025-10-13 · Updated 2025-10-13

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay DXP versions 2023.Q4.1 through 2023.Q4.5

Description An Insecure Direct Object Reference (IDOR) issue exists in Liferay DXP that allows authenticated remote users to access shipment addresses from different virtual instances. This occurs through the commerceOrderId parameter in the com liferay commerce order web internal portlet CommerceOrderPortlet component.

Recommendations Update Liferay DXP versions prior to 2023.Q4.6.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-62241

GHSA-FHCW-PX4Q-PMVV

Affected Products

Liferay Dxp

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-62241 · Security Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62241 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fhcw-px4q-pmvv · Vendor Advisory
• https://github.com/liferay/liferay-portal/commit/53401963f02f593bbf555b4b321fdaeb59e03a53 · Note
• https://github.com/liferay/liferay-portal/commit/75c39ea518eb91b3b5cbb0576074ebbbfd805401 · Note
• https://twitter.com/CVEnew/status/1977820914860654956 · Twitter Post
• https://liferay.atlassian.net/browse/LPE-17936 · Note
• https://t.me/CVEtracker/34787 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1977836441121005776 · Twitter Post