CVE-2025-62257
NoneLiferay Portal vulnerable to password enumeration
CVSS
—
EPSS
0.4%
Published
Oct 30, 2025
CISA due date
—
The record
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.120 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.120 |
Related vulnerabilities
- GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Same vulnerability
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs Also affects com.liferay.portal:release.portal.bom
- GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification Also affects com.liferay.portal:release.portal.bom