PT-2025-44059 · Liferay · Liferay Portal+1

4Rth4S · Published 2025-10-27 · Updated 2025-12-08 · CVE-2025-62259

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.109 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay Portal 7.4 GA through update 92

Description The software does not restrict access to APIs before a user has verified their email address. This allows remote users to access and edit content via the API.

Recommendations Update Liferay Portal to a version after update 92. Update Liferay DXP to a version after 2023.Q3.4. Update Liferay Portal version 7.3 to a version after update 35. Update Liferay Portal version 7.4 to a version after 7.4.3.109.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-62259

GHSA-GV7W-JH8G-VR73

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-gv7w-jh8g-vr73 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62259 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://t.me/CVEtracker/35912 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983000568353177682 · Twitter Post
• https://t.me/cveNotify/145120 · Telegram Post
• https://t.me/cveNotify/140574 · Telegram Post