PT-2025-42902 · Liferay · Liferay Portal+1

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-62250

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal 7.4 GA through update 92

Description An improper authentication issue exists in Liferay Portal and Liferay DXP. Remote attackers can send malicious data to the system that will be treated as trusted data via unauthenticated cluster messages.

Recommendations Liferay Portal versions 7.3 GA through update 35 should be updated. Liferay Portal versions 7.4.0 through 7.4.3.132 should be updated. Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 should be updated. Liferay DXP version 2023.Q4.0 should be updated. Liferay Portal 7.4 GA through update 92 should be updated.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2025-62250

GHSA-6PGJ-W687-9C8C

Affected Products

Liferay Dxp

Liferay Portal

References · 7

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62250 · Security Note
• https://osv.dev/vulnerability/GHSA-6pgj-w687-9c8c · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://liferay.atlassian.net/browse/LPE-17901 · Note
• https://t.me/CVEtracker/35416 · Telegram Post