CVE-2025-62266

The record

By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.

Affected packages

Related vulnerabilities

• GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Same vulnerability
• CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
• GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
• GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
• CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
• CVE-2025-62257 Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
• GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs Also affects com.liferay.portal:release.portal.bom
• GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification Also affects com.liferay.portal:release.portal.bom