CVE-2025-62250

MEDIUM

Liferay Digital Experience Platform < 7.3 - Improper Authentication via Unauthenticated Cluster Messages

Title source: llm
STIX 2.1

Description

Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0014
EPSS Percentile 4.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-346
Status published
Products (3)
com.liferay/com.liferay.portal.cluster.multiple 0 - 5.0.35Maven
liferay/digital_experience_platform 7.3 (41 CPE variants)
liferay/digital_experience_platform 7.4 (8 CPE variants)
Published Oct 21, 2025
Tracked Since Feb 18, 2026