PT-2025-43515 · Liferay · Liferay Portal+1

Published 2025-10-23 · Updated 2025-11-11 · CVE-2025-62256

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.109 Liferay DXP versions 2023.Q3.1 through 2023.Q3.7 Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 Liferay Portal 7.4 GA through update 92 older unsupported versions

Description The software does not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL. The OpenAPI YAML file can be accessed through a specifically designed URL.

Recommendations Liferay Portal versions 7.3 GA through update 35: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay Portal versions 7.4.0 through 7.4.3.109: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2023.Q3.1 through 2023.Q3.7: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2023.Q4.0 through 2023.Q4.5: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay Portal 7.4 GA through update 92: At the moment, there is no information about a newer version that contains a fix for this vulnerability. older unsupported versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Open Redirect

Weakness Enumeration

CWE-862

CWE-601

Related Identifiers

CVE-2025-62256

GHSA-F5VH-4RJ2-W8R8

GHSA-J82Q-C85J-XW4W

Affected Products

Liferay Dxp

Liferay Portal

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-62256 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62256 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5vh-4rj2-w8r8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j82q-c85j-xw4w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62266 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/bc6138ce1be22babbd90dc2190f4dbe91c039334 · Note
• https://github.com/liferay/liferay-portal/commit/27b51dbae35bd6e4b415fb33ecf14b2144b5038f · Note
• https://github.com/liferay/liferay-portal/commit/1ec03c02f2e0ecfdf4101c1a7ade5353767e62e3 · Note
• https://t.me/cveNotify/140119 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17884 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257 · Note
• https://t.me/cveNotify/142360 · Telegram Post
• https://t.me/CVEtracker/35577 · Telegram Post