CVE-2025-62253
NoneLiferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
CVSS
—
EPSS
0.2%
Published
Oct 27, 2025
CISA due date
—
The record
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay:com.liferay.layout.admin.web | 5.0.8 | 5.0.157 |
| maven | com.liferay/com.liferay.layout.admin.web | 5.0.8 | 5.0.157 |
Related vulnerabilities
- GHSA-2pwh-9q9q-5r9c Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_… Same vulnerability
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
- CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-601
- CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information… CWE-601
- CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics… CWE-601
- CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2… CWE-601