PT-2025-44021 · Liferay · Liferay Portal 7.3 Ga+5

Abderrahmane Bounhidja · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-62253

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.97 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Liferay Portal 7.4 GA through update 92

Description An open redirect issue exists in page administration functionality. This allows remote attackers to redirect users to arbitrary external URLs via the com liferay layout admin web portlet GroupPagesPortlet redirect parameter.

Recommendations Liferay Portal versions 7.3 GA through update 35: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay Portal versions 7.4.0 through 7.4.3.97: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP versions 2023.Q3.1 through 2023.Q3.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay DXP version 2023.Q4.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Liferay Portal 7.4 GA through update 92: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-62253

GHSA-2PWH-9Q9Q-5R9C

Affected Products

Liferay Dxp 2023.Q3.1

Liferay Dxp 2023.Q3.4

Liferay Dxp 2023.Q4.0

Liferay Portal 7.3 Ga

Liferay Portal 7.4 Ga

Liferay Portal 7.4.0

References · 8

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62253 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2pwh-9q9q-5r9c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62253 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62253 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/2835554ffe37ac4ba3b794e6d6c0bfd1dc8db301 · Note
• https://liferay.atlassian.net/browse/LPE-17838 · Note
• https://t.me/CVEtracker/35880 · Telegram Post